Category Archives: Block P2P

Monitoring performance of WFilter.

Leave a reply

WFilter Monitoring Performance

WFilter is designed to monitor a network with no more than 1000 computers, and the available internet bandwidth of the entire network shall be no more than 100Mbit/s.

Since WFilter is software, the performance depends a lot on the hardware performance. Higher bandwidth requires faster CPU, and more monitored computers require more RAM. Therefore, we recommend you to provide 1M available RAM for each monitored computer.

Below is a performance test result for HTTP request of WFilter 3.3 file-based version:

# Computers Bandwidth Total HTTP Requests Recorded Percent CPU Memory
1 50 37.2M 16000 100% 35% 260,298K
2 100 35M 20000 100% 38% 280,576K
3 200 31M 40000 100% 58% 294,561K
4 400 33M 80000 100% 68% 372,786K
5 600 32.3M 120000 100% 80% 540,151K
6 1000 32.6M 200000 60% 99% 540,664K

As we can see from the above table, when monitored computers number reachs 1000, the “recorded percent” decreased to 60% suddenly. And we noticed the memory only slightly increased, so it shall because lack of memory. Therefore we added the monitoring computer RAM to 2G, and do the test again:

# Computers Bandwidth Total HTTP Requests Recorded Percent CPU Memory
7 1000 32.7M 200000 100% 90% 820,640K

And the test of WFilter 3.3 database version(SQL Server) performance has the similar result:

# Computers Bandwidth Total HTTP Requests Recorded Percent CPU Memory
1 50 34.9M 10000 100% 45% 197,392K
2 100 34.9M 20000 100% 45% 210,196K
3 200 31M 40000 100% 45% 270,960K
4 400 32.9M 80000 100% 45% 364,234K
5 1000 28.6M 200000 58.84% 100% 540,664K

The performance of 1000-user can also be improved by adding RAM of the monitoring computer.

Test Environment

1 Network 100M ethernet
2 Test Client Intel(R) pentium(R) Dual 1.80+1.80GHz , 1G RAM
3 Test Monitoring Server Intel(R) Celeron(R) 2.66GHz, 1G RAM
4 WFilter Version WFilter 3.3
5 Switch Tplink TL-SF1008

WFilter 3.3 will come soon.

Leave a reply

  WFilter 3.3 is under alpha testing now. The new version will add “Bandwidth limit”, “Url keywords blocking”, “Website visit quota” and other exciting features.
  1. “Bandwidth limit”. You can set bandwidth limit for each computer, or blocking certain internet traffic when internet bandwidth is too high. This feature can help you to manage company bandwidth flexibly.
  2. “Url Keywords Blocking”, blocking url/webpage by keywords category. You may use this feature to block certain keywords from being searched in search engines.
  3. “Website visit quota”, by this feature, you are able to set visit time quota for each website category. For example, “news” websites can be limited to “1 hour” for each day.

 

How to block websites and restrict internet access?

Leave a reply

Most employees waste more than an hour on browsing web pages. Even worse, someone will not be able to concentrate on their work during work time.
So, to save productivity, it is necessary for organizations to block certain websites and restrict internet access.


In my opinion, things should be done from several aspects:


1. Only work-related websites are allowed during work time.
2. Destructive websites like violence, adult, shall be blocked always.
3. Downloading websites shall be blocked to save bandwidth if you are suffering from slow internet speed.


For those companies who are very strict with websites browsing, you can implement a website whitelist, by which, only websites in the whitelist can be visited.


More information, please refer to internet blocking and internet monitoring.

IMFirewall P2P Classify Engine Introduction

Leave a reply

IMFirewall P2P Classify Engine Introduction


1    Introduction


IMFirewall Software is a professional Internet filtering software provider. We focus on Internet information security and providing customers with a comprehensive approach to manage the Internet usage of enterprise network since founded in 2004. By 2007-10, protocols number supported in our pattern database has reached over 90. And our pattern analysis team is monitoring and analyzing protocols everyday.


2       Supported Pattern Type


Three pattern types are supported:


1.      Signature Pattern


You may call it digit signature. As most p2p programs do not has a fix port range nor central servers. The only way to match them is by signature match. IMFirewall pattern matching engine scans every connection for signature of existing protocols..


2.      Port Pattern


IMFirewall pattern matching engine can also recognize protocols by port or port range.


3.      HTTP Pattern


Because more and more protocols are using HTTP protocol or HTTP tunnel to communicate, our pattern-matching engine also checks http mime-header for signatures. HTTP pattern is powerful to recognize http-based protocols.


3       Pattern Matching Speed


We test the speed of each pattern when new pattern found, the standard speed is 20,000 matches in 1 second.


4       Quick Response for New (Updated) Protocols


As protocols may vary from time to time, it is necessary to keep the pattern database up to date in time.


We have a protocol/programs monitoring system, which will monitor the website and files on official websites of each protocol. Once there is a change, the system will notify our protocol analysis team to test it.


This makes us a quick response for new (updated) protocols. Usually, a updated protocol can be added to our pattern database in 2-3 business days.


 


Links: Supported protocols list of WFilter


 


How to Block Bittorrent and bitcomet using WFilter

Leave a reply

Someone told me WFilter can not block bittorrent downloading. So I did some research yesterday.


I downloaded both bittorrent and bitcomet from their official website. I also downloaded an availble torrent file from bittorrent.com.


Turning “Block P2P” on in WFilter console, then use bitcomet to download, the download never begined. However, when I use bittorrent to download, it will start downloading after trying for a few seconds.


This is really interesting. Since WFilter can detect and block bittorrent traffic using pattern match, this should not happen. So what’s the reason? After detailed analysis of the network traffic, I found bittorrent also download data directly from bittorrent.com using http protocol. That means bittorrent not only use p2p downloading, but also can download files directly from the website.


Knowing that, I added “bittorrent.com” in the black list of wfilter’s website black&white list, then did the download again. Aha, bittorrent never be able to download any files.


 


 

How to block msn file transfer?

Leave a reply

MSN, also called as live messenger is widely used. Windows Live Messenger gives you brilliant ways to connect and share your photos (and other stuff). Contact lists, emoticons, instant access to your friends.


However, sending and receiving files using MSN will face some security risk. External users can send files that might contain viruses or malicious code to users on the internal network. In addition, a liability risk arises if employees use the file transfer feature to share copyrighted music, movie or software files in violation of the law.


How to block msn file transfer?


MSN transfers files using dynamic ports which are negotiated. So it is impossilbe to block msn file transfer ports.


WFilter provides a efficient way to block msn file transfer. By using WFilter, It is very easy for you to detect and block MSN file transfers.


A more detailed example can be found here:


Example of blocking msn

How to block P2P traffic using WFilter

Leave a reply

A pure peer-to-peer network does not have the notion of clients or servers, but only equal peer nodes that simultaneously function as both “clients” and “servers” to the other nodes on the network. This model of network arrangement differs from the client-server model where communication is usually to and from a central server.


Some networks and channels such as Napster, OpenNAP and IRC server channels use a client-server structure for some tasks (e.g. searching) and a peer-to-peer structure for others. Networks such as Gnutella use a peer-to-peer structure for all purposes, and are sometimes referred to as true peer-to-peer networks, although Gnutella is greatly facilitated by directory servers that inform peers of the network addresses of other peers.


As you can see from above, a peer-to-peer network is complex and it is almost impossible for you to block p2p in the router or the gateway.


WFilter provides a efficient way to block p2p traffic by signature match. By using WFilter, It is very easy for you to detect and block p2p traffic and file downloading.


WFilter related features:



  • Detect p2p traffic in your network.
  • Implement a policy to block certain p2p traffic.
  • Support over 30 p2p protocols, cover most common p2p softwares.
  • Define a file extension list forbidden from being download.

 

Block online streaming using WFilter

Leave a reply

Block online streaming using WFilter


Various online streaming services are available on Internet, such as online movie, online music, online radio and ….


Some employees will spend a lot of time searching and watching such materials at work time, even worse, they will download copies of copyrighted popular music and movies, sharing of these copies among strangers is illegal in most jurisdictions.


So it is important for organizations to block online streaming, block internet radio, block p2p traffic, monitor Internet access to guard against unauthorized share or leak and enhance efficiency use of enterprise resources.


Using WFilter to block internet radio and streaming



WFilter also has complete protocol reports for you.


 


 




You also can use WFilter to monitor chat, monitor email, block messenger, block p2p and implement an internet access policy.