Welcome to Wanguard 9.0 User Guide!

Contents

• 1. Copyright & Trademark Notices
• 2. Andrisoft Wanguard Overview
  • 2.1. Key Features & Benefits
  • 2.2. Software Components
  • 2.3. Wanguard and Wansight
• 3. Choosing a Method of Traffic Monitoring
  • 3.1. Comparison between Packet Sniffing, Flow Monitoring, and SNMP Polling
• 4. Choosing a Method of DDoS Mitigation
  • 4.1. DDoS Mitigation with Wanguard Sensor
  • 4.2. DDoS Mitigation with Wanguard Filter
  • 4.3. Deployment Scenarios for Wanguard Filter
  • 4.4. Comparison between Deployment Scenarios
• 5. Software & Hardware Requirements
  • 5.1. Hardware Sizing Guideline
  • 5.2. System Requirements for Console
  • 5.3. System Requirements for Packet Sensor
  • 5.4. System Requirements for Flow Sensor
  • 5.5. System Requirements for SNMP Sensor
  • 5.6. System Requirements for Sensor Cluster
  • 5.7. System Requirements for Packet Filter
  • 5.8. System Requirements for Flow Filter
  • 5.9. System Requirements for Filter Cluster
• 6. Software Installation & Licensing
  • 6.1. Opening the Console
  • 6.2. Quick Configuration Steps
  • 6.3. Licensing Procedure
• 7. Basic Concepts of Wanguard Console
  • 7.1. User Interface Structure
  • 7.2. Keyboard Shortcuts
• 8. General Settings » Graphs & Storage
  • 8.1. Sensor and Applications Graph Troubleshooting
  • 8.2. IP/Subnet and Profiling Graph Troubleshooting
  • 8.3. AS and Country Graph Troubleshooting
• 9. General Settings » Custom Decoders
  • 9.1. Built-in Decoders
• 10. General Settings » Anomaly Detection
  • 10.1. Sweep Merge
  • 10.2. Threshold Anomalies
  • 10.3. Profile Anomalies
• 11. General Settings » Anomaly Mitigation
  • 11.1. Netfilter Rules (Implicit)
  • 11.2. Filtering Rules
• 12. Network & Policy » Response
  • 12.1. Response Actions
  • 12.2. Extending the Built-in Preconditions
  • 12.3. Built-in Response Actions
  • 12.4. Extending the Built-in Actions
• 13. Network & Policy » IP Zone
• 14. Network & Policy » Threshold Template
  • 14.1. Best Practices for Traffic Thresholds
• 15. Network & Policy » Profiling Template
• 16. Configuration » Servers
  • 16.1. Server Troubleshooting
  • 16.2. Distributing Sensors and Filters
  • 16.3. Accessing Remote Data via NFS
  • 16.4. Transferring Console
  • 16.5. Fault-Tolerant Console Setup
  • 16.6. Disaster Recovery Steps for Console
• 17. Components » Packet Sensor
  • 17.1. Packet Sensor Troubleshooting
  • 17.2. Optimization Steps for Intel XL710
  • 17.3. Optimization Steps for Intel 82599
• 18. Components » Flow Sensor
  • 18.1. Flow Sensor Troubleshooting
• 19. Components » SNMP Sensor
  • 19.1. SNMP Sensor Troubleshooting
• 20. Components » Sensor Cluster
• 21. Components » BGP Connector
  • 21.1. GoBGP Connector
  • 21.2. ExaBGP Connector
  • 21.3. Quagga Connector
  • 21.4. BGP Connector Troubleshooting
• 22. Components » Packet Filter
  • 22.1. Packet Filter Troubleshooting
• 23. Components » Flow Filter
  • 23.1. Flow Filter Troubleshooting
• 24. Components » Filter Cluster
• 25. Network & Policy » Whitelist Template
  • 25.1. Whitelist Template Permissions
• 26. Schedulers » Scheduled Reports
• 27. Schedulers » Event Reporting
• 28. General Settings » Data Retention
  • 28.1. Disk Full Troubleshooting
• 29. General Settings » Outgoing Email
• 30. General Settings » User Authentication
  • 30.1. LDAP
  • 30.2. RADIUS
  • 30.3. SAML 2.0 (SSO)
  • 30.4. HTTP Authentication
• 31. General Settings » User Management
  • 31.1. Roles
• 32. Reports » Tools » Anomalies
  • 32.1. Active Anomalies
  • 32.2. Anomaly Archive
  • 32.3. Anomaly Overview
  • 32.4. Anomaly Distribution
  • 32.5. Geo Distribution
• 33. Reports » Tools » Firewall
  • 33.1. Active Firewall Rules
  • 33.2. Filtering Rule Archive
  • 33.3. Filtering Rule Distribution
• 34. Reports » Tools » Routing
  • 34.1. Active BGP Announcements
  • 34.2. BGP Announcement Archive
  • 34.3. BGP Connector Events
• 35. Reports » Tools » Flows
  • 35.1. Flow Records
  • 35.2. Flow Tops
  • 35.3. Flow Graphs
• 36. Reports » Tools » Packets
  • 36.1. Active Packet Captures
  • 36.2. Packet Dump Archive
• 37. Reports » Devices » Overview
  • 37.1. Console
  • 37.2. Servers
  • 37.3. BGP Connectors
  • 37.4. Dataplane
  • 37.5. Sensor Clusters
  • 37.6. Packet Sensors
  • 37.7. Flow Sensors
  • 37.8. SNMP Sensors
  • 37.9. Filter Instances
• 38. Reports » Devices » Sensors
  • 38.1. Sensor Dashboard
  • 38.2. Sensor Graphs
  • 38.3. Sensor Tops
  • 38.4. Sensor Events
  • 38.5. Anomaly Overview
  • 38.6. AS Graphs
  • 38.7. Country Graphs
  • 38.8. Flow Records
  • 38.9. Flow Tops
  • 38.10. Flow Graphs
• 39. Reports » Devices » Filters
  • 39.1. Filter Dashboard
  • 39.2. Filter Graphs
  • 39.3. Filter Events
  • 39.4. Filter Instances
  • 39.5. Filtering Rule Archive
  • 39.6. Filtering Rule Distribution
  • 39.7. Geo Distribution
• 40. Reports » Dashboards
  • 40.1. Widgets
  • 40.2. Custom Widgets
• 41. Reports » IP Addresses & Groups
  • 41.1. IP Dashboard
  • 41.2. IP Graphs
  • 41.3. IP Accounting
  • 41.4. Anomaly Overview
  • 41.5. Profile Graphs
  • 41.6. Flow Records
  • 41.7. Flow Tops
  • 41.8. Flow Graphs
• 42. Reports » Servers
  • 42.1. Console / Server Dashboard
  • 42.2. Console & Server Graphs
  • 42.3. Console Events
  • 42.4. Server Events
  • 42.5. Server Commands
• 43. Appendix 1 – DPDK Configuration
  • 43.1. Overview
  • 43.2. System Requirements
  • 43.3. DPDK Installation
  • 43.4. Binding NICs to a DPDK-Compatible Driver
  • 43.5. Application Workflow
  • 43.6. DPDK Capture Engine Options
  • 43.7. Sizing the Lcore Plan
  • 43.8. DPDK Configuration Example
  • 43.9. GRE Tunnel Encapsulation
  • 43.10. Verifying the Running Configuration
  • 43.11. Troubleshooting
• 44. Appendix 2 – Configuring Flow Export
  • 44.1. Allied Telesis
  • 44.2. Arista
  • 44.3. Check Point
  • 44.4. Cisco
  • 44.5. Cumulus Linux & SONiC
  • 44.6. Extreme Networks
  • 44.7. Fortinet
  • 44.8. H3C
  • 44.9. HPE Aruba
  • 44.10. Huawei
  • 44.11. Juniper
  • 44.12. Linux Software Exporters
  • 44.13. Mikrotik
  • 44.14. Nokia
  • 44.15. Palo Alto Networks
  • 44.16. VyOS
  • 44.17. ZTE
• 45. Appendix 3 – Network Integration Guide
  • 45.1. Remotely Triggered Black Hole
  • 45.2. Interaction between RTBH and Traffic Diversion
  • 45.3. Traffic Diversion & Forwarding
• 46. Appendix 4 – Attributes & Tokens
  • 46.1. Anomaly-Related Tokens
  • 46.2. Time-Related Tokens
  • 46.3. IP Decoder-Related Tokens
  • 46.4. Filter-Related Tokens
  • 46.5. Filtering Rule-Related Tokens
  • 46.6. System-Wide Tokens
• 47. Appendix 5 – Using the REST API
  • 47.1. CLI Examples
  • 47.2. PHP Example
  • 47.3. Python Example