At first I configured the channel definition as follow:
#1:HTTP Protocol[TCP] and (SourcePort[80] or DestinationPort[80] or SourcePort[443] or DestinationPort[443]) #2:TCP Protocol[TCP] #3:UDP Protocol[UDP] #4:ICMP Protocol[ICMP]
Later, I modified it to add more channels:
#1:HTTP (Protocol[TCP] or Protocol[UDP]) and (SourcePort[80] or DestinationPort[80] or SourcePort[443] or DestinationPort[443]) #2:FTP Protocol[TCP] and (SourcePort[20-21] or DestinationPort[20-21]) #3:SFTP/SSH Protocol[TCP] and (SourcePort[22] or DestinationPort[22]) #4:SMTP Protocol[TCP] and (SourcePort[25] or DestinationPort[25] or SourcePort[587] or DestinationPort[587]or SourcePort[465] or DestinationPort[465]) #5:DNS Protocol[TCP] and (SourcePort[53] or DestinationPort[53]) #6:tFTP Protocol[UDP] and (SourcePort[69] or DestinationPort[69]) #7:POP3 Protocol[TCP] and (SourcePort[110] or DestinationPort[110]) #8:sFTP (Protocol[TCP] or Protocol[UDP]) and (SourcePort[115] or DestinationPort[115]) #9:IMAP Protocol[TCP] and (SourcePort[143] or DestinationPort[143]) #10:SNMP (Protocol[TCP] or Protocol[UDP]) and (SourcePort[161] or SourcePort[162] or DestinationPort[161] or DestinationPort[162]) #11:FTPS Protocol[TCP] and (SourcePort[989-990] or DestinationPort[989-990]) #12:IMAPS Protocol[TCP] and (SourcePort[993] or DestinationPort[993]) #13:WinSrvUpSrv (Protocol[TCP] or Protocol[UDP]) and (SourcePort[8530-8531] or DestinationPort[8530-8531]) #14:LogMeInHamachi Protocol[TCP] and (SourcePort[12975] or SourcePort[32976] or DestinationPort[12975] or DestinationPort[32976]) #15:L2TP Protocol[115] #16:EspAh Protocol[50-51] #17:GRE Protocol[47] #18:TCP Protocol[TCP] #19:UDP Protocol[UDP] #20:ICMP Protocol[ICMP]
Problem is, I got now two channels for TCP, UDP, ICMP:
1. HTTP 1,759 MByte 94 % 2. TCP 99 MByte 5 % 3. ICMP 7,574 KByte < 1 % 4. SNMP 4,192 KByte < 1 % 5. UDP 1,397 KByte < 1 % 6. ICMP 922 KByte < 1 % 7. IMAPS 459 KByte < 1 % 8. POP3 131 KByte < 1 % 9. TCP 8,256 Byte < 1 % 10. UDP 5,498 Byte < 1 % 11. WinSrvUpSrv 647 Byte < 1 % Other 0 Byte < 1 %
Seems like new channel definition was appended to first channel definition, it was not replaced.
Add comment