D-Link 800 - DFL 800 - Security Appliance, User Manual

Page: 395 / 469

afterwards when other connections will be opened and subject to traffic shaping. Connections
opened after the Time Window has expired will no longer be subject to traffic shaping.
A Time Window of 0 means that only traffic flowing over the initial triggering connection will
be subject to traffic shaping. Any associated connections that do not trigger an IDP rule will
not be subject to traffic shaping.
5. Optionally specify a Network
If the Time Window is greater than zero, a Network can be specified. This IP address range
allows the administrator to further refine the subsequent connections associated with IDP rule
triggering that will be subject to traffic shaping. At least one side of associated connection has
to be in the IP range specified for it to be included in traffic shaping.
10.2.3. Processing Flow
To better understand how IDP Traffic Shaping is applied, the following are the processing steps that
occur:
1. A new connection is opened by one host to another through the D-Link Firewall and traffic
begins to flow. The source and destination IP address of the connection is noted by
NetDefendOS.
2. The traffic flowing on the connection triggers an IDP rule. The IDP rule has Pipe as action so
the traffic on the connection is now subject to the pipe traffic shaping bandwidth specified in
the IDP rule.
3. A new connection is then established that does not trigger an IDP rule but has a source or
destination IP that is the same as the connection that did trigger a rule. If the source or
destination is also a member of the IP range specified as the Network, then the connection's
traffic is included in the pipe performing traffic shaping for the original triggering connection.
If no Network is specified then this new connection is also included in the triggering
connection's pipe traffic if source or destination match.
10.2.4. The Importance of Specifying a Network
Either Side Can Trigger IDP
After reading through the processing flow description above, it can be better understood why
specifying a Network is important. The IDP subsystem cannot know which side of a connection is
causing a rule to trigger. Sometimes it is the initiating client side and sometimes the responding
server. If traffic flow on both sides becomes restricted, this may have the unintended consequence of
traffic shaping connections that should not be traffic shaped.
Unintended Consequences
To explain this unintended traffic shaping, consider a client A that connects to host X with P2P
traffic and triggers an IDP rule with the Pipe action so the connection becomes subject to traffic
shaping. Now, if another client B also connects to host X but this time with web surfing traffic, an
IDP rule is not triggered but the connection should not be traffic shaped along with client A's
connection just because host X is involved.
Excluding Hosts
To avoid these unintended consequences, we specify the IP addresses of client A and client B in the
10.2.3. Processing Flow Chapter 10. Traffic Management
395