Welcome to Wanguard 8.5 User Guide!¶

Contents

1. Copyright & Trademark Notices
2. Andrisoft Wanguard Overview
- 2.1. Key Features & Benefits
- 2.2. Software Components
- 2.3. Wanguard and Wansight
3. Choosing a Method of Traffic Monitoring
- 3.1. Comparison between Packet Sniffing, Flow Monitoring, and SNMP Polling
4. Choosing a Method of DDoS Mitigation
- 4.1. DDoS Mitigation with Wanguard Sensor
- 4.2. DDoS Mitigation with Wanguard Filter
- 4.3. Deployment Scenarios for Wanguard Filter
- 4.4. Comparison between Deployment Scenarios
5. Software & Hardware Requirements
- 5.1. Hardware Sizing Guideline
- 5.2. System Requirements for Console
- 5.3. System Requirements for Packet Sensor
- 5.4. System Requirements for Flow Sensor
- 5.5. System Requirements for SNMP Sensor
- 5.6. System Requirements for Sensor Cluster
- 5.7. System Requirements for Packet Filter
- 5.8. System Requirements for Flow Filter
- 5.9. System Requirements for Filter Cluster
6. Software Installation & Licensing
- 6.1. Opening the Console
- 6.2. Quick Configuration Steps
- 6.3. Licensing Procedure
7. Basic Concepts of Wanguard Console
- 7.1. User Interface Structure
8. General Settings » Graphs & Storage
- 8.1. Sensor and Applications Graph Troubleshooting
- 8.2. IP/Subnet and Profiling Graph Troubleshooting
- 8.3. AS and Country Graph Troubleshooting
9. General Settings » Custom Decoders
- 9.1. Built-in Decoders
10. General Settings » Anomaly Detection
- 10.1. Threshold Anomalies
- 10.2. Profile Anomalies
11. General Settings » Anomaly Mitigation
- 11.1. Netfilter Rules (Implicit)
- 11.2. Filtering Rules
12. Network & Policy » Response
- 12.1. Response Actions
- 12.2. Extending the Built-in Preconditions
- 12.3. Built-in Response Actions
- 12.4. Extending the Built-in Actions
13. Network & Policy » IP Zone
14. Network & Policy » Threshold Template
- 14.1. Best Practices for Traffic Thresholds
15. Configuration » Servers
- 15.1. Server Troubleshooting
- 15.2. Distributing Sensors and Filters
- 15.3. Accessing Remote Data via NFS
- 15.4. Transferring Console
- 15.5. Fault-Tolerant Console Setup
- 15.6. Disaster Recovery Steps for Console
16. Components » Packet Sensor
- 16.1. Packet Sensor Troubleshooting
- 16.2. Optimization Steps for Intel XL710
- 16.3. Optimization Steps for Intel 82599
17. Components » Flow Sensor
- 17.1. Flow Sensor Troubleshooting
18. Components » SNMP Sensor
- 18.1. SNMP Sensor Troubleshooting
19. Components » Sensor Cluster
20. Components » BGP Connector
- 20.1. GoBGP Connector
- 20.2. ExaBGP Connector
- 20.3. Quagga Connector
- 20.4. BGP Connector Troubleshooting
21. Components » Packet Filter
- 21.1. Packet Filter Troubleshooting
22. Components » Flow Filter
- 22.1. Flow Filter Troubleshooting
23. Components » Filter Cluster
24. Network & Policy » Whitelist Template
25. Schedulers » Scheduled Reports
26. Schedulers » Event Reporting
27. General Settings » Data Retention
- 27.1. Disk Full Troubleshooting
28. General Settings » Outgoing Email
29. General Settings » User Authentication
- 29.1. LDAP
- 29.2. RADIUS
30. General Settings » User Management
- 30.1. Roles
31. Reports » Tools » Anomalies
- 31.1. Active Anomalies
- 31.2. Anomaly Archive
- 31.3. Anomaly Overview
- 31.4. Anomaly Distribution
32. Reports » Tools » Firewall
- 32.1. Active Firewall Rules
- 32.2. Filtering Rule Archive
- 32.3. Filtering Rule Distribution
- 32.4. Geo Distribution
33. Reports » Tools » Routing
- 33.1. Active BGP Announcements
- 33.2. BGP Announcement Archive
- 33.3. BGP Connector Events
34. Reports » Tools » Flows
- 34.1. Flow Records
- 34.2. Flow Tops
35. Reports » Tools » Packets
- 35.1. Active Packet Captures
- 35.2. Packet Dump Archive
36. Reports » Devices » Overview
- 36.1. Console
- 36.2. Servers
- 36.3. BGP Connectors
- 36.4. Dataplane
- 36.5. Sensor Cluster
- 36.6. Packet Sensors
- 36.7. Flow Sensors
- 36.8. SNMP Sensors
- 36.9. Filters
37. Reports » Devices » Sensors
- 37.1. Sensor Dashboard
- 37.2. Sensor Graphs
- 37.3. Sensor Tops
- 37.4. Sensor Events
- 37.5. Anomaly Overview
- 37.6. AS Graphs
- 37.7. Country Graphs
- 37.8. Flow Records
- 37.9. Flow Tops
38. Reports » Devices » Filters
- 38.1. Filter Dashboard
- 38.2. Filter Graphs
- 38.3. Filter Events
- 38.4. Filter Instances
- 38.5. Filtering Rules Archive
- 38.6. Filtering Rules Distribution
- 38.7. Geo Distribution
39. Reports » Dashboards
- 39.1. Widgets
40. Reports » IP Addresses & Groups
- 40.1. IP Dashboard
- 40.2. IP Graphs
- 40.3. IP Accounting
- 40.4. Anomaly Overview
- 40.5. Profile Graphs
- 40.6. Flow Records
- 40.7. Flow Tops
41. Reports » Servers
- 41.1. Console / Server Dashboard
- 41.2. Console / Server Graphs
- 41.3. Console Events
- 41.4. Server Events
- 41.5. Server Commands
42. Appendix 1 – DPDK Configuration
- 42.1. DPDK Installation
- 42.2. Application Workflow
- 42.3. DPDK Capture Engine Options
- 42.4. DPDK Configuration Example
43. Appendix 2 – Configuring Flow Export
- 43.1. Flow Export on older IOS Devices
- 43.2. Flow Export on CatOS Device
- 43.3. Flow Export on Native IOS Device
- 43.4. Flow Export on 4000 Series Switch
- 43.5. Flow Export on IOS XE
- 43.6. Flow Export on IOS XR
- 43.7. Flow Export on IOS-XE Everest
- 43.8. Flow Export on Juniper
- 43.9. Flow Export on Juniper MX
- 43.10. Flow Export on Huawei
- 43.11. Flow Export on Mikrotik
44. Appendix 3 – Network Integration Guide
- 44.1. Remotely Triggered Black Hole
- 44.2. Interaction between RTBH and Traffic Diversion
- 44.3. Traffic Diversion & Forwarding
45. Appendix 4 – Attributes & Tokens
- 45.1. Anomaly-Related Tokens
- 45.2. Time-Related Tokens
- 45.3. IP Decoder-Related Tokens
- 45.4. Filter-Related Tokens
- 45.5. Filtering Rule-Related Tokens
- 45.6. System-Wide Tokens
46. Appendix 5 – Using the REST API
- 46.1. CLI Example
- 46.2. PHP Example