9. General Settings » Custom Decoders

Decoders are internal functions (traffic dissectors) that identify and categorize the protocols in each packet or flow. Dozens of built-in decoders come pre-installed. If you don’t require custom decoders, you can safely skip this section.

To manage user-defined decoders, go to Configuration » General Settings » Custom Decoders. The panel lists the existing custom decoders in a grid that shows their Name, Description, and Color. Use the [Add Decoder], [Edit Decoder], and [Delete Decoder] buttons to manage them; double-clicking a row also opens it for editing. These buttons change only the grid — click [Save] to apply the changes.

The Add Custom Decoder and Edit Custom Decoder windows group the parameters into three sections: Flow Matching Expressions, Packet Matching Expressions, and Advanced Settings. Each custom decoder is defined by the following parameters:

● Decoder Name – A short name to help you identify the decoder. This field is mandatory and accepts at most 8 characters

● Decoder Color – The color used in graphs for the decoder, chosen from the color trigger attached to the Decoder Name field. The default is a random color

● Decoder Description – An optional short description of the decoder

● Flow Syntax – This syntax is used by Flow Sensor and Flow Filter. Examples:

• To match TCP flows having only the SYN flag set, enter flags S and not flags AFRPU

• To match flows with the MPLS label0 set to 2, enter mpls label0=2

• To match memcached packets, enter proto 17 and port 11211

● GoBGP Syntax – Enter a Flowspec expression if you intend to use a GoBGP Connector with Flowspec. Examples:

• To match memcached packets, enter port 11211 protocol 17

• To rate-limit memcached packets instead of discarding them, append the action: port 11211 protocol 17 rate-limit 1000000

● ExaBGP Syntax – Enter a Flowspec expression if you intend to use an ExaBGP Connector with Flowspec. Examples:

• To match memcached packets, enter port 11211; protocol 17;

• To rate-limit memcached packets instead of discarding them, append the action: port 11211; protocol 17; rate-limit 1000000;

A trailing rate-limit (in bytes per second) or accept action replaces the default discard in the announced Flowspec rule. Everything from the action keyword to the end of the expression is used as the action, so it must come last. A GoBGP Connector honors the action when it has the Mitigation role or no next-hop configured. An ExaBGP Connector honors it when it has the Mitigation role and a community, extended community, or large community configured, or when it has no community and no next-hop at all. Other Connectors ignore the action

● BPF Syntax – This syntax is used by Packet Sensor and Packet Filter when the Capture Engine parameter is not set to DPDK. Examples:

• To match TCP packets with the SYN flag set, enter tcp[tcpflags] & tcp-syn!=0

• To match UDP packets with the destination port under 1024, enter proto 17 and dst portrange 1-1023

• To match memcached packets, enter proto 17 and port 11211

● ACL Syntax for IPv4 and ACL Syntax for IPv6 – Two separate fields, used by Packet Sensor and Packet Filter only when the Capture Engine parameter is set to DPDK. With DPDK, a decoder whose ACL fields are empty matches no packets. Each field accepts one or more lines, and the decoder matches a packet that matches any line. A line consists of eight mandatory fields separated by single spaces, with ranges written as low-high and single values as value-value:

• source IP/mask and destination IP/mask – An address with a mask length from 0 to 32 for IPv4 or from 0 to 128 for IPv6. Enter 0.0.0.0/0 or ::/0 to match any address

• source port range and destination port range – Enter 0-65535 to match any port

• IP protocol range – Enter 0-255 to match any protocol, 6-6 for TCP, or 17-17 for UDP

• TCP flags/hex bitmask – The bitmask selects the flag bits to compare and the value gives their required state, using the bit values FIN 1, SYN 2, RST 4, PSH 8, ACK 16, and URG 32. Enter 0/0x0 to ignore the TCP flags

• IP fragment/hex bitmask – Enter 0/0x0 to match all packets, or 1/0xf to match only fragmented IPv4 packets

• IP length range – Enter 0-65535 to match any packet size

Examples:

• To match IPv4 TCP packets with the SYN flag set and the ACK flag unset, enter 0.0.0.0/0 0.0.0.0/0 0-65535 0-65535 6-6 2/0x12 0/0x0 0-65535

• To match all IPv4 packets from 8.8.8.8, enter 8.8.8.8/32 0.0.0.0/0 0-65535 0-65535 0-255 0/0x0 0/0x0 0-65535

• To match IPv4 TCP packets with source port 80 or destination port 80, enter two lines: 0.0.0.0/0 0.0.0.0/0 80-80 0-65535 6-6 0/0x0 0/0x0 0-65535 and 0.0.0.0/0 0.0.0.0/0 0-65535 80-80 6-6 0/0x0 0/0x0 0-65535

• To match IPv6 TCP packets with source port 80, enter ::/0 ::/0 80-80 0-65535 6-6 0/0x0 0/0x0 0-65535 in the IPv6 field

● Included Decoders – Select the decoders that include the matched traffic, or choose IP if not sure. This field is mandatory and defaults to IP. It is used when stacking decoders in IP graphs, and by the Ignore Duplicates feature from Anomaly Detection

● Conflicting Decoders – Select the decoders that might match the same traffic, but not always. This optional field is used only for displaying stacked decoders inside IP graphs

● Filter Engine – If you intend to use Wanguard Filter, select the most specific Filter Engine that could analyze the traffic. Otherwise, select Disabled, which is the default. The available options are Disabled, Generic IPv4/IPv6, TCP, TCP and UDP, UDP, ICMP, and OTHER

● Netfilter Expression – Enter Netfilter/iptables argument(s) that match the same traffic also matched by the decoder to prevent irrelevant packets from passing the Netfilter firewall. This field stays disabled while Filter Engine is set to Disabled

Every expression field has a star icon to its right, the Bookmarks & Syntax Help button. The window it opens combines a Syntax Help panel with a list of saved Bookmarks: select one and click [Insert Selection] — double-clicking works too — to copy it into the field, and use [Add], [Modify], and [Delete] to maintain your own expressions.

Note

To generate IP Graphs, Tops and Accounting data for a custom decoder, enable it in Configuration » General Settings » Graphs & Storage. To use the decoder for thresholds, enable it in Configuration » General Settings » Anomaly Detection. Sensors that use custom decoders are restarted when you save, and a Sensor fails to start when one of the decoder’s matching expressions is invalid, so check the event log after adding a decoder.

9.1. Built-in Decoders

IP	Matches all IP packets, regardless of higher-layer protocols. Always enabled.
IPV4	Matches all IPv4 packets, regardless of higher-layer protocols
IPV6	Matches all IPv6 packets, regardless of higher-layer protocols
TCP	Matches TCP traffic
TCP+SYN	Matches TCP traffic with the SYN flag set and ACK unset. Flow Sensor counts one packet per flow
UDP	Matches UDP traffic
ICMP	Matches ICMP traffic (IP protocol 1) and ICMPv6 traffic (IP protocol 58)
OTHER	Matches IP protocols other than TCP, UDP, and ICMP
INVALID	Matches TCP or UDP port 0, or IP protocol 0
FLOWS	Matches flow records and replaces packets/s with flows/s. Works only with Flow Sensor
FLOW+SYN	Matches flow records with the SYN flag set. Flow Sensor counts all packets per flow. Works only with Flow Sensor
FRAGMENT	Matches fragmented IP packets. Works only with Packet Sensor
TCP-NULL	Matches TCP traffic without TCP flags (indicative of reconnaissance sweeps)
TCP+RST	Matches TCP traffic with the RST flag set
TCP+ACK	Matches TCP traffic with the SYN flag unset and ACK set
TCP+SYNACK	Matches TCP traffic with both SYN and ACK flag set
NETBIOS	Matches TCP traffic on source or destination port 139
QUIC	Matches Google’s QUIC protocol on UDP ports 80 and 443
UDP-QUIC	Matches UDP traffic that is not part of the QUIC protocol
MEMCACHED	Matches UDP traffic on port 11211
HTTP	Matches TCP traffic on source or destination port 80
HTTPS	Matches TCP traffic on source or destination port 443
MAIL	Matches TCP traffic on source or destination ports 25, 110, 143, 465, 585, 587, 993, 995
DNS	Matches UDP traffic on source or destination port 53
SIP	Matches TCP or UDP traffic on source or destination port 5060
IPSEC	Matches IP traffic on IP protocols 50 or 51
WWW	Matches TCP traffic on source or destination ports 80 or 443
SSH	Matches TCP traffic on source or destination port 22
NTP	Matches UDP traffic on source or destination port 123
SNMP	Matches UDP traffic on source or destination ports 161 or 162
RDP	Matches TCP or UDP traffic on source or destination port 3389
YOUTUBE	Matches IP traffic to or from YouTube AS 43515, 36561, or YouTube subnets
NETFLIX	Matches IP traffic to or from Netflix AS 55095, 40027, 2906, or Netflix subnets
HULU	Matches IP traffic to or from Hulu AS 23286 or Hulu subnets
FACEBOOK	Matches IP traffic to or from Facebook AS 54115, 32934, 63293, or Facebook subnets
SSDP	Matches Simple Service Discovery Protocol traffic on UDP port 1900
TCP+ALL	Matches TCP traffic with all flags set (Xmas attack)
TCP+FIN	Matches TCP traffic with the FIN flag set
TCP+RST+FIN	Matches TCP traffic with the RST and FIN flags set
TCP+ACK+PSH	Matches TCP traffic with the ACK and PSH flags set
TCP0	Matches TCP traffic on source or destination port 0
UDP0	Matches UDP traffic on source or destination port 0
LDAP	Matches LDAP traffic on TCP port 389
CLDAP	Matches Connectionless LDAP traffic on UDP port 389
CHARGEN	Matches Character Generator Protocol traffic on port 19
SLP	Matches Service Location Protocol traffic on port 427
GRE	Matches Generic Routing Encapsulation traffic (IP protocol 47)
ARMS	Matches Apple Remote Management Service traffic on UDP port 3283
COAP	Matches Constrained Application Protocol traffic on UDP port 5683
MSSQLRS	Matches Microsoft SQL Server Resolution Service traffic on UDP port 1434
STUN	Matches Session Traversal Utilities for NAT traffic on UDP port 3478
WSDD	Matches Web Services Dynamic Discovery traffic on UDP port 3702
RIPV1	Matches Routing Information Protocol version 1 traffic on UDP port 520
MDNS	Matches Multicast DNS traffic on UDP port 5353
RPCBIND	Matches RPC Portmapper traffic on UDP port 111
NBNS	Matches NetBIOS Name Service traffic on UDP ports 137 and 138