1) Minimum Requirements
2) Recommended Requirements
3) How to calculate the hard disk and memory space WFilter needed?
| Componment Name | Describe | Default Install Directory |
|---|---|---|
| WFilter | Main installation package. Installed list: 1. Service: WFilterd. 2. Process: startsys.exe,webservd.exe. |
C:\Program Files\IMFirewall\WFilter |
WFilter provides an independent Internet content filtering solution. WFilter can support most common Internet communication protocols and using WFilter will not affect your network performance.
Consider the capability of a computer, we recommend you to monitor no more than 1000 computers from a single windows machine. To monitor more computer, WFilter should be distributed on two or more dedicated machines, depending on your operating environment. These dedicated machines can use a central database for data storage.
WFilter is fully compatible with routers, switches and gateways. Typically, you can deploy WFilter in below network environment:
Network Considerations
Some deployment examples in practice are listed in our deployment examples. For better understanding, please refer to WFilter Deployment Examples.
A single segment network is a logically connected nodes operating in the same portion of the network. These nodes can be PCs, printers, other networked devices. In a such a network, WFilters must be installed where they can monitor Internet traffic across the entire network. You may set the monitor mode to "by MAC address" in "Monitoring Settings".
As in Figure5.1.1, local computers use a wired router to connect to the Internet. Under this type network, it requires a port mirroring switch or a broadcasted hub to installed between the router and the switch. And the machine with WFilter installed on shall be connected to the monitor port of the port mirroring switch or the hub.
As most broadcasted hub only works in 10Mb speed, we recommend you use a port mirroring switch if your internet bandwidth is larger than 4Mb.
Depending on the device connecting multiple network segments, some traffic may not be sent to all segments. A router, bridge or smart hub may serve as traffic control, preventing unneeded traffic from being sent to a segment. In such a situation, we can not use "by MAC address" mode because the MAC address of a computer will be masked by the router.
Two solutions are available for multiply segments network:
You can put WFilter at a single location and use "by IP address" mode. But this will cause some trouble if your users change their IP address rapidly. We suggest you use "IP-MAC binding" to avoid unauthorized change of IP address.
As in Figure 5.2.1, it requires a port mirroring switch or a broadcasted hub be installed between the router and the switch. And the machine with WFilter installed on shall be connected to the monitor port of the port mirroring switch or the hub. You also need to set monitor mode to "by IP address" in "Monitor Settings" of WFilter.
The second solution is deploying WFilter in each network segment. And all the dedicated machines of WFilter use a central network database.
If your proxy server runs on a windows system, you may install WFilter on the proxy server to monitor the whole network.
If you prefer not to install WFilter on the proxy server. You can install a port mirroring switch or a broadcasted hub between the switch and the proxy server.
Network Topology:
You also need to add the proxy server ip address into the "Local Servers" in "Monitor Settings" of WFilter.
Basically, a computer connected to a switch or a route can only receive its own traffic. To monitor other computers, your machine shall be able to monitor other computer's Internet traffic.
A broadcasted hub is a data packet repeater commonly used in broadcast networks. In a broadcast network, a node will send a packet that traverses through every other node until the recipient accepts the packet. Every node in the network will conceivably receive this packet of data until the recipient processes the packet. In a broadcast network, all packets are sent in this manner. So each computer connected to a broadcasted hub can monitor other computers.
In a switched network, packets are not broadcasted, but are processed in the switched hub which, in turn, will create a direct connection between the sending and recipient nodes using the unicast transmission principles. This eliminates the need to broadcast packets to each node, thus lowering traffic overhead.
The advent of switched networks resulted in Network IDS having great difficulty in promiscuously monitoring their networks. This can be overcome by configuring a switch to replicate the data from all ports or VLAN's onto a single port. This function has a multitude of names including: Port Mirroring, Monitoring Port, Spanning Port, SPAN port and Link Mode port.
Generally Port Mirroring and port span usually indicates the ability to copy the traffic from a single port to a mirror port.
Some switches do not allow SPAN ports to transmit packets, this is an issue if you wish to use WFilter blocking features. If the mirror port of your switch is recv-only, you need to add a network adapter to the computer WFilter in installed on to enable blocking features.
As described above,to monitor all Internet traffic,should consider two conditions:
A broadcasted hub is a data packet repeater commonly used in broadcast networks.
Most broadcasted hubs provide a uplink port to connect with a up layer device. You shall connect the up layer device to the uplink port of the hub ( Note: Do not use the port next to the uplink port).
As in Figure 6.2:
Most broadcasted hubs only work in 10Mb speed, and all the computers connected to the hub will share the bandwidth. For example, if two computer connected, each will have 5Mb bandwidth. So we recommend you use a port mirroring switch if your internet bandwidth larger than 4Mb.
The machine with WFilter installed shall be connected to the mirror port of a switch. As in Figure6.3.
You only need to mirror the traffic of the router to WFilter.
Different switch provide different configuration.Below we provide some common switchs' port mirroring configuration.
How to use "Huawei Lanswitch View" management system to add a mirror port:
In 3COM switch,port mirroring is named as "Roving Analysis".The port been mirrored is called as "Monitor Port", The mirror port is called as "Analyzer Port".Configuration commands:
Define an analyzer portCISCO CATALYST has two series. The mirror port is named as "analysis port".
1. Catalyst 2900XL/3500XL/2950(CLI based)