Datto Networking Appliance (DNA): Web traffic filters
In networking, filters are types of software that can analyze and classify network traffic by its detected content. They make routing and traffic shaping changes to the traffic based on a set of predefined rules. The Datto Networking Appliance and legacy Open Mesh devices use the following filter definitions to classify traffic:
| Filter Name | Group | Notes |
|---|---|---|
| bittorrent | P2P | filters only unencrypted bittorrent traffic |
| dcpp | P2P | protocol filter for direct connect |
| ftp | P2P | protocol filter |
| dropbox | onlinebackup | SSL-name filter |
| dropbox_lansync | onlinebackup | LAN local dropbox traffic (port 17500) |
| ibackup | onlinebackup | protocol filter |
| icloud | onlinebackup | HTTP filter for icloud.com and used amazon AWS servers |
| backblaze | onlinebackup | SSL-name filter |
| mozy | onlinebackup | SSL-name filter |
| onedrive | onlinebackup | HTTP filter for Microsoft OneDriver Cloud Storage domains |
| ultrashare | webfilesharing | HTTP filter for *.ultrashare.com |
| filefactory | webfilesharing | HTTP filter for *.filefactory.com |
| gamefront | webfilesharing | HTTP filter for *.gamefront.com |
| massmirror | webfilesharing | HTTP filter for *.massmirror.com |
| uploadcom | webfilesharing | SSL-name filter for cnet.com |
| downloadcom | webfilesharing | HTTP filter for *.cnet.com |
| thepiratebay | webfilesharing | SSL-name and HTTP filter for *.thepiratebay.se (note: main traffic will be done via bittorrent) |
| torrentzeu | webfilesharing | SSL-name and HTTP filter for *.torrentz.eu (note: main traffic will be done via bittorrent) |
| 4shared | webfilesharing | SSL-name and HTTP filter for *.4shared.com |
| easynews | webfilesharing | SSL-name and HTTP filter for *.easynews.com |
| mediafire | webfilesharing | HTTP filter for *.mediafire.com |
| youtube | web2.0 | filters for content and RTMPE stream from youtube/ytimg.com |
| googlesocial | web2.0 | SSL-name and HTTP filter for *.gstatic.com, *.googleusercontent.com, *ggpht.com - covers different google services, including picasa |
| flickr | web2.0 | SSL-name and HTTP filter for *.flickr.com, *.staticflickr.com |
| smugmug | web2.0 | SSL-name and HTTP filter for *.smugmug.com |
| imgurcom | web2.0 | SSL-name and HTTP filter for *.imgur.com |
| photobucketcom | web2.0 | HTTP filter for *.pbsrc.com, *.photobucket.com |
| imageshack | web2.0 | SSL-name and HTTP filter for *.imgshack.com |
| imgly | web2.0 | SSL-name and HTTP filter for *.img.ly, HTTP GET */imgly_production |
| web2.0 | SSL-name and HTTP filter *.instagr.am, *.instagram.com | |
| tumblr | web2.0 | HTTP filter for tumblr.com and CDN network |
| yfrog | web2.0 | SSL-name and HTTP filter *.yfrag.com |
| yelp | web2.0 | HTTP filter *.yelp. *, *.yelpcdn.com |
| web2.0 | SSL-name and HTTP filter for *.twitter.com, *.twimg.com | |
| web2.0 | SSL-name and HTTP filter for *.facebook.com, *.fbcdn.net | |
| skype | voip | special kernel module, skype connections cannot be identified in the first packets. This makes the detection rather slow and less usable for blocking. Skype will detect the block after a while and create a new connection using a different method. This connection will work some seconds until it is again classified as skype |
| vocera | voip | port filter for portrange 5300-5400 - WARNING untested due to lack of proprietary devices |
| teamspeak | voip | protocol filter |
| ventrilo | voip | protocol filter |
| sip | voip | layer 7 filter for SIP signaling (works on all ports), Limitation: RTP streams (audio data) are only associated to SIP if the SIP signaling was on port 5060 (standard IANA port for SIP) |
| yahoomail | SSL-name and HTTP filter for *.mail.yahoo. * | |
| googlemail | SSL-name filter for mail.google.com | |
| hotmail | SSL-name and HTTP filter for *.mail.live.com | |
| hostbasedemail | port filter for typical SMTP/POP3/IMAP ports: 143,993,25,465,587,110,995 | |
| ign | gaming | SSL-name and HTTP filter for *.ign.com |
| miniclip | gaming | SSL-name and HTTP filter for *.miniclip.com |
| gamespot | gaming | SSL-name and HTTP filter for *.gamespot.com and *.gamespotcdn.com |
| bigfishgames | gaming | SSL-name and HTTP filter for *.bigfishgames.com and *.bigfishsites.com |
| zynga | gaming | SSL-name and HTTP filter for *.zynga.com and *.zgncdn.com |
| pogo | gaming | SSL-name and HTTP filter for *.pogo.com |
| xboxlive | gaming | protocol filter and game downloads |
| steam | gaming | steam downloads, store and social content |
| battlenet | gaming | port based filter and game downloads |
| playstation | gaming | port based filter and game downloads |
| speedtestnet | speedtest | filter matching speedtest.net bandwidth test (and similar sites using the same infrastructure) |
| wikipedia | webpop | Filter for Wikipedia/Mediawiki content |
| webpop | Filter for other google pages like maps.google.com or google.com | |
| aboutcom | webpop | Filter matching about.com (without videos) |
| askcom | webpop | Filter matching ask.com |
| wikileaks | webpop | Filter matching the wikileaks main page (not the mirrors) |
| ebay | webpop | Filters official ebay website (does not include content from users stored on random, external servers) |
| webpop | ||
| wordpresscom | webpop | Filter for the content from wordpress.com (not user content from external servers) |
| wordpressorg | webpop | Filter for the content from wordpress.org (not blogs based on the wordpress.org CMS) |
| adserver | webpop | HTTP domain filter for domains which are known to only serve advertisement |
| amazon | webpop | Filter for the amazon shop with music and video filter (not the webservices and cloud) |
| bing | webpop | Filter for the Microsoft Bing search and map tools |
| yahoo | webpop | Filter for the Yahoo portal website (some subpages may not be supported) |
| msn | webpop | Filter for the MSN portal website (some subpages may not be supported) |
| blogger | webpop | Filter for the content from blogspot.com (not user content from external servers) and the admin website blogger.com |
| ustream | media | Filter for the content from ustream.tv (see rtmp_ustream for the RTMP content) |
| rtmp_ustream | media | Filter for the RTMP streams of ustream.tv |
| rhapsody | media | Filter for the content from rhapsody.com (see rtmp_rhapsody for the RTMP content) |
| rtmp_rhapsody | media | Filter for the RTMP streams of rhapsody.com |
| xfinity | media | Filter for the content from xfinitytv.comcast.net (see rtmp_xfinity for the RTMP content) |
| showtime | media | Filter for the content from Showtime and Showtime Anytime |
| rtmp_xfinity | media | Filter for the RTMP streams directly from xfinitytv.comcast.net (this doesn't include content from third party content like hulu) |
| livestream | media | Filter for the content from livestream.com (see rtmp_livestream for the RTMP content) |
| rtmp_livestream | media | Filter for the RTMP streams of livestream.com |
| http_audio | fallback | Filter for audio files send over HTTP |
| http_video | fallback | Filter for video files send over HTTP |
| brightcove | media | filters for video stream CDN service brightcove |
| shoutcast | media | Radio streams sent through the HTTP IceCast/Shoutcast server |
| spotify | media | Filter for content from spotify.com (does not include the data sent between the clients in the secret P2P protocol) |
| itunes | media | Filter for content from itunes.apple.com and HTTP requests from the iTunes client |
| bliptv | media | Filter for content from blip.tv |
| dailymotion | media | Filter for content from dailymotion.com |
| hulu | media | Filter for content from hulu.com (see rtmp_hulu for the RTMPE content) |
| rtmp_hulu | media | Filter for the RTMPE streams of hulu.com |
| lastfm | media | Filter for content from last.fm |
| pandora | media | Filter for content from pandora.com |
| rdio | media | Filter for content and RTMPE streams from rd.io |
| soundcloud | media | Filter for content from soundcloud.com |
| vimeo | media | Filter for content from vimeo.com |
| netflix | media | Filter for content from netflix |
| amazonmusic | media | Filter for content streamed over Amazon Prime Music |
| amazonvideo | media | Filter for content streamed over US Amazon Prime Video |
| sctp | fallback | filter matching the layer 4 protocol "Stream Control Transmission Protocol" (automatically added as fallback filter) |
| ah | fallback | filter matching the layer 4 protocol "IPSec Authentication Header" (automatically added as fallback filter) |
| esp | fallback | filter matching the layer 4 protocol "IPSec Encapsulating Security Payload" (automatically added as fallback filter) |
| icmp | fallback | filter matching the layer 4 protocol "Internet Control Message Protocol" (automatically added as fallback filter) |
| udplite | fallback | filter matching the layer 4 protocol "Lightweight User Datagram Protocol" (automatically added as fallback filter) |
| udp | fallback | filter matching the layer 4 protocol "User Datagram Protocol" (automatically added as fallback filter) |
| tcp | fallback | filter matching the layer 4 protocol "Transmission Control Protocol" (automatically added as fallback filter) |
| quic | fallback | filter matching the layer 4+ protocol "Quick UDP Internet Connections" (automatically added as fallback filter) |
| igmp | fallback | filter matching the layer 4 protocol "Internet Group Management" (automatically added as fallback filter) |
| gre | fallback | filter matching the layer 4 protocol "General Routing Encapsulation" (automatically added as fallback filter) |
| ipip | fallback | filter matching the layer 4 protocol "IP-within-IP Encapsulation Protocol" (automatically added as fallback filter) |
| l2tp | fallback | filter matching the layer 4 protocol "Layer Two Tunneling Protocol" (automatically added as fallback filter) |
| nytimes | news | filter matching webpage nytimes.com |
| techcrunch | news | filter matching webpage TechCrunch |
| gizmodo | news | filter matching webpage Gizmodo.com |
| sinacomcn | news | filter matching webpage sina.com.cn |
| foxnews | news | filter matching webpage Fox News |
| cnn | news | filter matching webpage CNN.com |
| turner | news | filter matching content shared between Turner webpages (CNN, ...) |
| webcam | media | Detect video stream from FOSCAM IP cameras |
| twitchtv | media | Detect archived video and website of twitch.tv |
| hbogo | media | Detect content (website, videos) from hbogo.com |
| rtmp | media | Detect video transfers which are using known RTMP formats |
| facetime | media | filter matching TURN (video, media and sip in one UDP stream) of facetime |
| adserver | webpop | Filter matching well known advertisement server of HTTP and HTTPS (SNI) traffic |
