Classify Custom Networks

You can classify custom networks on the packet side or the flow side. This example shows how a custom network is defined. After the network is defined, the DPA rule can use logic that depends on whether or not the traffic belongs to that network. In this instance, a log message is printed only if any end sessions that were on the defined local network are discovered.

function Flow_ClassifyCustomNetworkTraffic (dpiMsg, ruleEngine)

  require 'LOG'

  require 'IPv4LanDefine'

  if (ipRange == nil) then

    ipRange = IPv4LanDefine:new('10.0.0.0', '10.0.0.10')

end

  if IsFinalLongFlow(dpiMsg) or IsFinalShortFlow(dpiMsg) then

    local destip = GetDstIP4Int(dpiMsg)

    local srcip = GetSrcIP4Int(dpiMsg)

    if (ipRange:IsInLan(destip) or ipRange:IsInLan(srcip)) then

      EZINFO("Local network traffic found, srcip: " .. GetSrcIP4String(dpiMsg) .. ", dstip: " .. GetDstIP4String(dpiMsg))

end

end

end