Version 3.3.0 implements a flow-filtering feature that uses certain rules/conditions. In each rule you can specify conditions and actions that are to be performed when conditions match a certain flow. You can use the following types of actions; deny, modify or allow. The action "deny" drops flow. Dropped flow is not stored into the database. "Deny" action can be used for removing unwanted traffic from accounting. The "modify" action replaces flow with values that are specified in the set fields and continues with flow filtering. "Allow" action works similarly to the "modify" action, but it doesn't continue to filter flow. In other words allowed flow is stored into database, modified flow may or may not need to be stored into the database (it depends on which allow or deny rules follow). The default rule is to permit any flow.
For each rule you can specify up to 10 conditions and 10 "set fields". CFI software is using the logical 'AND' for the conditions (i.e. if you will set condition 0: source IP address >= 10.0.0.0 and condition 1: source IP address<=10.255.255.255 it means that the source IP address must be in the range between 10.0.0.0 and 10.255.255.255).
![]() | Warning |
---|---|
There are no rule limits, but be very careful in how many rules and conditions you create. Filtering consumes a lot of CPU time! |
Filtering feature can also be used for replacing a source IP address. If you are receiving netflow traffic through a netflow forwarder, incoming netflow shows IP of the forwarding device, instead of the IP address of the router that sent this information. The filtering feature has the ability to change the IP address which will correspond with the original device that sent the information. Section 4.4, “Collector settings” assign the created filter list to the collector that will filter the NDE.