0

we are looking to use WFilter to monitor workstation traffic, it looks like we need a router or switch that does port mirroring, now would that mean we need a managed switch? And if so, would all the switches we use in the building need to be managed, or just the one on the "end" right before our internet connection?

I have never messed with managed switches so it would all be new to me. Seems like I've read somewhere in the past, that if you want to capture the kind of per-computer information like WFilter captures, you need managed switches anyways?

We basically want to see what websites each computer is looking at, and block sites per computer as needed. We use openDNS right now, and it blocks sites on ALL the computers on our network, And some people like myself need to use sites such as Facebook since our company has a Facebook page, and to get around it I have to manually use a different DNS server in my NIC settings which is inconvenient, and also affects my connection to our AD server sometimes.

Improve this question

1 Answer 1

Reset to default
1

There are many ways you can set up WFilter. You can have your border switch - the one connecting your router to the internal network and mirror all the packets going to your router. This way, you'll get the IP address of the machine originating the traffic on the internal side.

You can get it closer to the source - the switches the PC connect to, send all the traffic to a central WFilter - but that will increase your network traffic.

You need a switch with port mirror capability. You can alternatively (I don't recommend personally) put a hub (not a switch) where you connect your WFilter, Router and the feed from the rest of your network. Because a hub does not switch but copies the packet to all ports, you get the "same" as port mirroring.

You can also setup Wfilter with pass-through mode where you have two NIC in your PC and one goes to the internal network, the second to the internet router. All traffic is routed through the PC.

See http://www.imfirewall.us/support/WFilter_4_0/Doc/deployment_example.htm for all the ways you can set it up.

Improve this answer
2
  • Ok, great, so if I bought one managed switch that does port mirroring, and put it in place of the current un-managed switch that is connected to the router, and of course hooked up the WFilter computer to it, I should be good?
    – thegaffney
    Apr 29, 2013 at 15:46
  • Yes, provided that the managed switch has the port mirroring (also sometimes called port monitor) feature. Just make sure it does and you'll be fine. You can also go for the switches documented in the WFilter deployment examples.
    – ETL
    Apr 29, 2013 at 16:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .