Hello knowledgebase people :-)
Having just upgraded from v6 to v9 (yes, I know), I am on a steep learning curve! However, I was hoping that my massive collection of custom packet sniffing channel defs would transfer across ok - I seem to be having some issues though.
Summary: On a custom packet sniffer sensor I have defined a number of channels, only the first of which is visible and selectable. Another custom sniffer has multiple channels and is working as expected.
My PRTG server has one NIC patched to a monitor session on our core switch, receiving all traffic from our data VLANs.
I have created a number of custom packet sniffer sensors, one of which captures traffic from the LAN to our hosted servers. This traffic goes over a VPN tunnel but that is transparent as far as the monitor session is concerned.
I want to capture both inbound and outbound traffic for various channels and so I have the following include filter and channel definitions (some values changed).
Thanks in advance.
Include filter:
( IP[10.0.a.0/24] or IP[10.0.b.0/24] or IP[10.0.c.0/24] or IP[10.0.d.0/24] )
Channel defs:
#1:InboundSQL Protocol[TCP] and SourcePort[1433] and ( SourceIP[10.0.a.0/24] or SourceIP[10.0.b.0/24] or SourceIP[10.0.c.0/24] or SourceIP[10.0.d.0/24] ) #2:OutboundSQL Protocol[TCP] and DestinationPort[1433] ( DestinationIP[10.0.a.0/24] or DestinationIP[10.0.b.0/24] or DestinationIP[10.0.c.0/24] or DestinationIP[10.0.d.0/24] ) #3:InboundWWW Protocol[TCP] and SourcePort[80] ( SourceIP[10.0.a.0/24] or SourceIP[10.0.b.0/24] or SourceIP[10.0.c.0/24] or SourceIP[10.0.d.0/24] ) #4:OutboundWWW Protocol[TCP] and DestinationPort[80] ( DestinationIP[10.0.a.0/24] or DestinationIP[10.0.b.0/24] or DestinationIP[10.0.c.0/24] or DestinationIP[10.0.d.0/24] ) #5:InboundRDP Protocol[TCP] and SourcePort[3389] ( SourceIP[10.0.a.0/24] or SourceIP[10.0.b.0/24] or SourceIP[10.0.c.0/24] or SourceIP[10.0.d.0/24] ) #6:OutboundRDP Protocol[TCP] and DestinationPort[3389] ( DestinationIP[10.0.a.0/24] or DestinationIP[10.0.b.0/24] or DestinationIP[10.0.c.0/24] or DestinationIP[10.0.d.0/24] ) #7:InboundDNS Protocol[UDP] and SourcePort[53] ( SourceIP[10.0.a.0/24] or SourceIP[10.0.b.0/24] or SourceIP[10.0.c.0/24] or SourceIP[10.0.d.0/24] ) #8:OutboundDNS Protocol[UDP] and DestinationPort[53] ( DestinationIP[10.0.a.0/24] or DestinationIP[10.0.b.0/24] or DestinationIP[10.0.c.0/24] or DestinationIP[10.0.d.0/24] )
Add comment