Blocking free customer WiFi computers.

[Mike2010]

Hi, I just purchased a 25 license bundle and installed it on a Windows XP machine.



I have two issues-



1. The WFilter doesn't seem to be monitoring anything; I have two NICs in this machine, one assigned with an IP address of the subnet that it's filtering, and the other one plugged into the mirrored WAN port on the main switch. I know this port is mirroring correctly because I'm already using a packet sniffer to monitor our bandwidth and that works just fine. The problem is, I don't see a protocol to check in the network adapter settings, such as "wfilter network monitor" or something along those lines. What protocol does it use and how do I go about installing it?



2. The second question I have is, I will be using this to filter the internet for our free customer WiFi, usually not more than 5 computers connected at once. The IP addresses will be continously changing on the client ends, will this cause an issue with block inappropriate websites or will it be effective as soon as they connect and start browsing?

[gengw2000]

1. First issue might be a "IP Segment Settings" issue. From the settings you uploaded, I noticed your "IP Segments settings" is configured as "192.168.10.0/24", which makes WFilter only monitors "192.168.10.0/24" subnet. However, in "User-computer Table", I only see computers from "20.1.1.0", "20.1.10.0" and "20.1.6.0".



So what are the exact ip segments you want to monitor? Can you send me a network topology diagram for me to check?



2. When WFilter find a new IP address, it will check your default monitoring policy to assign a default monitoring policy to this ip address. However, if your monitoring computers number exceeds the license limit, the new found computers will not be monitored.

Therefore, since the customer computers will not be more than 5 computers, I recommend you to narrow down your WiFi DHCP range to 5 ip addresses. So you can set filtering policy for the fixed 5 ip addresses.

[Mike2010]

Not sure where the the 20.1.1.0 IPs are coming from, but when I check the

user computer table I'm showing computers in the 192.168.10.0 subnet. I'm

more concerned with the fact that the NIC that I have plugged into the

mirrored port on my Dell Switch isn't capturing any packets. When I click on

"monitor settings", I see that it's up and running, but not capturing any

packets. When I click on "check settings" and it goes through the 6 tests,

it simply replies with "unavailable, please try again later".



My network topology is two wireless routers (static IPs 192.168.10.5,

192.168.10.6, each running DHCP limited 10 ten for the clients), pointing to

our cable modem. So I have the WAN ports on our routers plugged into the

switch, and then the port that plugs into the cable modem for our WAN

connection is mirrored and plugged into the second NIC on the machine

running WFilter.



Any thoughts?

[gengw2000]

This rarely happens.



It seems WFilter can not start the monitoring process. It could be blocked by a firewall program. Which firewall program are you using? And did WFilter evaluation version work before?



Anyway, please re-install WFilter to fix it. Just launch the installation package and choose "re-install", you will not lose any settings or monitored data(you also don't need to activate the key again).



If this problem still exists, please check "temp" directory of WFilter to check whether there have error logs named like "Err_20101013.txt". Please send the most recent error log to me if exists.



And what is your windows OS version?

[Mike2010]

I just installed it on a completely new computer and it seems to be working now. I believe it was some issues on the other machine with the Network Cards, and possibly some software conflicts.



One thing I wanted to suggest, in my experiences with almost any other web filtering/packet sniffing program being used on a mirror port, you always had to disable all protocols on the port except the protocol that the filtering/sniffing program used to collect packets. There was no mention of NOT changing the NIC protocols, so I thought it was an issue with that. Just a suggestion, might be good to mention that in your documentation somewhere.