Welcome to Wanguard 8.5 User Guide!

Contents

• 1. Copyright & Trademark Notices
• 2. Andrisoft Wanguard Overview
  • 2.1. Key Features & Benefits
  • 2.2. Software Components
  • 2.3. Wanguard and Wansight
• 3. Choosing a Method of Traffic Monitoring
  • 3.1. Comparison between Packet Sniffing, Flow Monitoring, and SNMP Polling
• 4. Choosing a Method of DDoS Mitigation
  • 4.1. DDoS Mitigation with Wanguard Sensor
  • 4.2. DDoS Mitigation with Wanguard Filter
  • 4.3. Deployment Scenarios for Wanguard Filter
  • 4.4. Comparison between Deployment Scenarios
• 5. Software & Hardware Requirements
  • 5.1. Hardware Sizing Guideline
  • 5.2. System Requirements for Console
  • 5.3. System Requirements for Packet Sensor
  • 5.4. System Requirements for Flow Sensor
  • 5.5. System Requirements for SNMP Sensor
  • 5.6. System Requirements for Sensor Cluster
  • 5.7. System Requirements for Packet Filter
  • 5.8. System Requirements for Flow Filter
  • 5.9. System Requirements for Filter Cluster
• 6. Software Installation & Licensing
  • 6.1. Opening the Console
  • 6.2. Quick Configuration Steps
  • 6.3. Licensing Procedure
• 7. Basic Concepts of Wanguard Console
  • 7.1. User Interface Structure
• 8. General Settings » Graphs & Storage
  • 8.1. Sensor and Applications Graph Troubleshooting
  • 8.2. IP/Subnet and Profiling Graph Troubleshooting
  • 8.3. AS and Country Graph Troubleshooting
• 9. General Settings » Custom Decoders
  • 9.1. Built-in Decoders
• 10. General Settings » Anomaly Detection
  • 10.1. Threshold Anomalies
  • 10.2. Profile Anomalies
• 11. General Settings » Anomaly Mitigation
  • 11.1. Netfilter Rules (Implicit)
  • 11.2. Filtering Rules
• 12. Network & Policy » Response
  • 12.1. Response Actions
  • 12.2. Extending the Built-in Preconditions
  • 12.3. Built-in Response Actions
  • 12.4. Extending the Built-in Actions
• 13. Network & Policy » IP Zone
• 14. Network & Policy » Threshold Template
  • 14.1. Best Practices for Traffic Thresholds
• 15. Configuration » Servers
  • 15.1. Server Troubleshooting
  • 15.2. Distributing Sensors and Filters
  • 15.3. Accessing Remote Data via NFS
  • 15.4. Transferring Console
  • 15.5. Fault-Tolerant Console Setup
  • 15.6. Disaster Recovery Steps for Console
• 16. Components » Packet Sensor
  • 16.1. Packet Sensor Troubleshooting
  • 16.2. Optimization Steps for Intel XL710
  • 16.3. Optimization Steps for Intel 82599
• 17. Components » Flow Sensor
  • 17.1. Flow Sensor Troubleshooting
• 18. Components » SNMP Sensor
  • 18.1. SNMP Sensor Troubleshooting
• 19. Components » Sensor Cluster
• 20. Components » BGP Connector
  • 20.1. GoBGP Connector
  • 20.2. ExaBGP Connector
  • 20.3. Quagga Connector
  • 20.4. BGP Connector Troubleshooting
• 21. Components » Packet Filter
  • 21.1. Packet Filter Troubleshooting
• 22. Components » Flow Filter
  • 22.1. Flow Filter Troubleshooting
• 23. Components » Filter Cluster
• 24. Network & Policy » Whitelist Template
• 25. Schedulers » Scheduled Reports
• 26. Schedulers » Event Reporting
• 27. General Settings » Data Retention
  • 27.1. Disk Full Troubleshooting
• 28. General Settings » Outgoing Email
• 29. General Settings » User Authentication
  • 29.1. LDAP
  • 29.2. RADIUS
• 30. General Settings » User Management
  • 30.1. Roles
• 31. Reports » Tools » Anomalies
  • 31.1. Active Anomalies
  • 31.2. Anomaly Archive
  • 31.3. Anomaly Overview
  • 31.4. Anomaly Distribution
• 32. Reports » Tools » Firewall
  • 32.1. Active Firewall Rules
  • 32.2. Filtering Rule Archive
  • 32.3. Filtering Rule Distribution
  • 32.4. Geo Distribution
• 33. Reports » Tools » Routing
  • 33.1. Active BGP Announcements
  • 33.2. BGP Announcement Archive
  • 33.3. BGP Connector Events
• 34. Reports » Tools » Flows
  • 34.1. Flow Records
  • 34.2. Flow Tops
• 35. Reports » Tools » Packets
  • 35.1. Active Packet Captures
  • 35.2. Packet Dump Archive
• 36. Reports » Devices » Overview
  • 36.1. Console
  • 36.2. Servers
  • 36.3. BGP Connectors
  • 36.4. Dataplane
  • 36.5. Sensor Cluster
  • 36.6. Packet Sensors
  • 36.7. Flow Sensors
  • 36.8. SNMP Sensors
  • 36.9. Filters
• 37. Reports » Devices » Sensors
  • 37.1. Sensor Dashboard
  • 37.2. Sensor Graphs
  • 37.3. Sensor Tops
  • 37.4. Sensor Events
  • 37.5. Anomaly Overview
  • 37.6. AS Graphs
  • 37.7. Country Graphs
  • 37.8. Flow Records
  • 37.9. Flow Tops
• 38. Reports » Devices » Filters
  • 38.1. Filter Dashboard
  • 38.2. Filter Graphs
  • 38.3. Filter Events
  • 38.4. Filter Instances
  • 38.5. Filtering Rules Archive
  • 38.6. Filtering Rules Distribution
  • 38.7. Geo Distribution
• 39. Reports » Dashboards
  • 39.1. Widgets
• 40. Reports » IP Addresses & Groups
  • 40.1. IP Dashboard
  • 40.2. IP Graphs
  • 40.3. IP Accounting
  • 40.4. Anomaly Overview
  • 40.5. Profile Graphs
  • 40.6. Flow Records
  • 40.7. Flow Tops
• 41. Reports » Servers
  • 41.1. Console / Server Dashboard
  • 41.2. Console / Server Graphs
  • 41.3. Console Events
  • 41.4. Server Events
  • 41.5. Server Commands
• 42. Appendix 1 – DPDK Configuration
  • 42.1. DPDK Installation
  • 42.2. Application Workflow
  • 42.3. DPDK Capture Engine Options
  • 42.4. DPDK Configuration Example
• 43. Appendix 2 – Configuring Flow Export
  • 43.1. Flow Export on older IOS Devices
  • 43.2. Flow Export on CatOS Device
  • 43.3. Flow Export on Native IOS Device
  • 43.4. Flow Export on 4000 Series Switch
  • 43.5. Flow Export on IOS XE
  • 43.6. Flow Export on IOS XR
  • 43.7. Flow Export on IOS-XE Everest
  • 43.8. Flow Export on Juniper
  • 43.9. Flow Export on Juniper MX
  • 43.10. Flow Export on Huawei
  • 43.11. Flow Export on Mikrotik
• 44. Appendix 3 – Network Integration Guide
  • 44.1. Remotely Triggered Black Hole
  • 44.2. Interaction between RTBH and Traffic Diversion
  • 44.3. Traffic Diversion & Forwarding
• 45. Appendix 4 – Attributes & Tokens
  • 45.1. Anomaly-Related Tokens
  • 45.2. Time-Related Tokens
  • 45.3. IP Decoder-Related Tokens
  • 45.4. Filter-Related Tokens
  • 45.5. Filtering Rule-Related Tokens
  • 45.6. System-Wide Tokens
• 46. Appendix 5 – Using the REST API
  • 46.1. CLI Example
  • 46.2. PHP Example