1 Download and Decompress WFilter
As in Figure1.1, after download WFilter and decompress it with WinZip, you will find two files.
Figure 1.1
Double click WFilter_en_N_N.exe to install it.
WFilter and WFilter databased version is all the same except data storage. WFilter stores monitored data in local harddisk while WFilter database version stores data into the database.
2 Installation Note
2.1 Calculate Hard Disk Space Needed
Before installation, you should make sure the disk WFilter installed on has enough disk space. The basic installation of WFilter only needs 20MB hard disk space, but monitored data requires more. Each monitored computer will cost about 2MB hard disk space one day if you use "High" record level. You can backup and purge monitored data in "Log Management" of WFilter.
Hard disk space needed = computer number(N) * 2MB * days
2.2 Installation of WFilter DataBase Version
If you want to install WFilter database version, you should install database first. WFilter database version supports SQL Server and MySQL database. Please refer to "WFilter Database Version Installation Guide".
3 Launching WFilter Console
You can launch WFilter console by clicking the WFilter shortcut on desktop, or run it from "Start" -> "Programs" -> "IMFirewall" -> "WFilter Console". If you choose not to create shortcut during installation, you need to type "http://localhost:9090" in your browser address bar to access WFilter console.
As in Figure3.1, Input "admin" in "USER ID" and default password "123456" in "PASS", and then click "Login".
Figure 3.1
As in Figure3.2, after successful login, you can see all monitored online computers.
Figure 3.2
If the location of WFilter in your network is incorrect or configuration error, WFilter will have problem to monitor other computers.
If no computer presents in "Online Computers", the "Monitoring Adapter" setting may be incorrect. Please refer to Monitor Settings.
If only the computer with WFilter installed on exists in "Online Computers", this means WFilter is not deployed at the correct place. Please refer to "How to deploy WFilter?".
4 Configure WFilter
4.1 Monitor Settings
If no computer presents in "Online Computers", there are two possibilities:
1. You haven't have any network activity yet. Please visit some websites and refresh "Online Computers".
2. The listening device is configured incorrectly. As in Figure4.1, click "Monitor Setting" and check whether current listening device is correct.
Figure 4.1
4.2 How to specify computers need to be monitored?
As in Figure4.2, click the "User-computer Table". Check the "Enable Monitor" checkbox of the computer you want to monitor and save.
Figure 4.2
If your licensed monitoring number is smaller than total number of choosed computers, WFilter will only monitor first found licensed number computers.
5 How to deploy WFilter?
5.1 Introduction
WFilter can be installed on a single Windows machine for a small network(1-1000 Users).
WFilter analyses network traffics to do monitoring. So WFilter should be deployed at a location where it can see all Internet traffics.
Basically, a computer connected to a switch or a route can only receive its own traffic.
A broadcasted hub is a data packet repeater commonly used in broadcast networks. In a broadcast network, a node will send a packet that traverses through every other node until the recipient accepts the packet. Every node in the network will conceivably receive this packet of data until the recipient processes the packet. In a broadcast network, all packets are sent in this manner.So each computer connected to a broadcasted hub can monitor other computers.
In a switched network, packets are not broadcasted. This was overcome by configuring a switch to replicate the data from all ports or VLAN's onto a single port. This function has a multitude of names including: Port Mirroring, Monitoring Port, Spanning Port, SPAN port and Link Mode port.
As described above,to monitor all Internet traffic,should consider two conditions:
1. The machine with WFilter installed on shall be connected to the mirror port of a switch supports port mirroring or a broadcasted hub.
2. All Internet traffic passes through this broadcasted hub or switch.
The detailed deployment depends on different network topology. Here we take a typical small network environment as an example. Please refer to "WFilter Deployment Guide" for more information.
5.1 A Typical Small Network
As in Figure5.1, local computers use a wired router to connect to the Internet. In this type of network, it requires a port mirroring switch or a broadcasted hub to be installed between the router and the switch. And the machine with WFilter installed on shall be connected to the monitor port of the port mirroring switch or the hub.
As most broadcasted hub only works in 10Mb speed, we recommend you use a port mirroring switch if your internet bandwidth larger than 4Mb.
Figure 5.1
Some deployment examples in practice are listed in our deployment examples. For better understanding, please refer to WFilter Deployment Examples.
5.2 Switch's Usage and Port Mirroring
The machine with WFilter installed on shall be connected to the mirror port of a switch. As in Figure5.2.
Figure 5.2
If you want to monitor all Internet traffic, you should configure port J as the target mirror port, and configure port A as the source mirror port. So the port J can receive all the data transfered through the router.
If you also want to monitor local servers, as local mail servers, proxy servers and file servers. Suppose a local email server is connected to port H, you should also mirror port H's traffics to port J.
5.3 Broadcasted Hub's Usage
A broadcasted hub is a data packet repeater commonly used in broadcast networks.
Most broadcasted hubs provide an uplink port. As in Figure5.3, you shall connect the switch to the uplink port of the hub (Note: Do not use the nearby port with the uplink). And connect the computer with WFilter installed on to the hub.
Figure 5.3