Juniper Advanced Threat Prevention Appliance, Cli Command Reference Manual, Page: 31 / 120

CLI Command Reference Guide
Copyright© 2018, Juniper Networks, Inc. 23
set traffic-filter (collector mode)
set protocols (collector mode)
Table 2-19 set traffic-filter
Description
Sets traffic filter rules to avoid analysis on a set of configured traffic, which cannot
be made retroactive; for example: any analysis skipped as a result of the filtering
cannot be reversed. This command can be applied to an entire network/subnet/
CIDR range.
See Also: set (server mode); show (diagnosis mode) [show traffic-filter]
Product(s) CLI All-in-One | Collector
Mode(s) collector
Syntax
set traffic-filter {add <rule_name> <domain> <source-
address> <destination-address> <source-port>
<destination-port> <protocol> | remove <rule_name>}
Parameters
Example
The following example add a traffic filter rule to the Traffic Collector.
JATP-collector02(collector)# set traffic-rule add
CustomRule2 headqrts.example.com 10.2.00/16 20.0.0.2
90 120 tcp
where destination-address is 20.0.0.2, destination-port is 120, protocol is tcp,
source-address is 10.2.0.0/16 and source-port is 90 (in our example).
Table 2-20 set protocols
Description
Enables and disables the HTTP or SMB parser for a Traffic Collector.
See Also:
show protocols
command in show (collector mode)
Product(s) CLI All-in-One | Collector
Mode(s) collector
Syntax
(collector)# set protocols {http [on|off] | smb [on|off]}
Example
The following example enables the SMB parser for lateral detections:
hostname (collector) set protocols smb on
traffic-filter add
<RuleString><Dom
ainString><source-
address>
<destin
ation-address>
<source-port>
<destination-
port>
<protocol>
Adds a traffic filter rule where:
“RuleString” is the name of the rule
“DomainString” is the domain to filter out
“source-address” is the source IPv4 address or network
(CIDR)
“destination-address” is the destination IPv4 address or
network (CIDR)
“source-port” is the source port number (0-65535)
“destination-port” is the destination port number (0-65535)
“protocol” is the protocol type: either IP, TCP, UDP or HTTP