Shopping Cart
Your shopping cart is empty!

FAQ's

Deployment

  1. Will WFilter influence my network speed?
  2. Why is nothing being displayed by WFilter?
  3. Why can WFilter only monitor the computer it is installed on?
  4. I can see other computers in "View Current Online", but all the records are empty.
  5. I cannot login into WFilter, the browser shows "This page can not be displayed".
  6. I cannot access WFilter's console from other computers.
  7. Can I access the WFilter Console from the Internet?
  8. What is ARP spoof?
  9. Does using WFilter pose a risk of exposing our organization's privacy?
  10. How does WFilter work?
     

Usage

  1. Why is QQ's password needed to see QQ's chat content?
  2. How to block tencent QQ?
  3. Can I select the computers that I wish to monitor (rather than all the computers)?
  4. How can I determine the owner's name of a computer?
  5. How do I identify a computer's MAC address?
  6. How do I configure the firewall to allow WFilter to operate?
  7. How do I change WFilter's listening port?
  8. Can WFilter monitor e-mails received and sent by a web browser?
  9. Why can I only monitor messages sent but cannot monitor messages received?
  10. If I want to monitor more computers than I initially purchased, what should I do?

 

Deployment

D-1. Will WFilter influence my network speed?

In short, No.

WFilter can be deployed either in 'Pass-by' or 'Pass-through' mode. For greater detail on these configurations and the pro's and con's refer here or the Documentation section. However in summary, in 'Pass by' mode WFilter cannot have any effect on Internet through-put as WFilter analyses copies of the network packets (via a mirroring port) and does not delay the original packets. In contrast in 'Pass-through' mode, WFilter is installed as a gateway and the network packets pass through WFilter. So in theory in 'Pass-through' mode it is possible for WFilter to become a bottleneck if the hardware performance of the WFilter computer is insufficient. However in practice most SME organisations will have a 10Mb link or less to the Internet, so with a Core2Duo processor or higher and 2 - 4GB of RAM, the bottleneck will be the Internet connection rather than WFilter.

D-2. Why is nothing being displayed by WFilter?

D-3. Why can WFilter only monitor the computer it is installed on?

If you're deploying in 'Pass by' mode, it's most likely because you're not using a broadcasted hub or a port mirror switch. WFilter should be installed at a location where it can see all Internet traffic. Please refer to the "Deployment Guide" in the Documentation section for more information.

D-4. I can see other computers in "View Current Online", but all the records are empty.

Refer to answer D-3 above.

D-5. I cannot login into WFilter, the browser shows "This page can not be displayed".

D-6. I cannot access WFilter's console from other computers.

D-7. Can I access the WFilter Console from the Internet?

Of course. If WFilter is installed on a computer which is not directly connected to the Internet (which is the recommended approach), you just need to configure port forwarding on the router.

D-8. What is ARP spoof?

ARP spoof can spoof other computers to take your computer (WFilter) as the gateway. This allows you to monitor other computers without using a broadcasted hub or a port mirror switch. But if your computer hangs or powers off without exiting ARP spoof correctly, the computers being spoofed will not be able to reach Internet for several minutes. So you need to use ARP spoof carefully.

D-9. Does using WFilter pose a risk of exposing our organization's privacy?

No. WFilter runs in your LAN and does not access the Internet except for version check. All messages and data that is monitored is archived on the WFilter computer. No data is sent externally by WFilter.

D-10. How does WFilter work?

This is covered in greater detail in the Documentation section, but in brief.

In 'Pass-by' mode broadcasted hubs or port mirror switches allow the WFilter computer to receive a copy of other computers' network packets. WFilter then analyses these packets and based on the configured policies blocks or permits the requested data. In 'Pass-through' mode WFilter scans the packets as they pass through WFilter's network bridge.

In 'Pass-by' mode a TCP connection can easily be destroyed by some fake packets. This is how WFilter blocks TCP connections. But UDP connections cannot be blocked in this way as UDP is a connection-less protocol. For this reason in 'Pass-by' mode WFilter cannot block UDP connections. Instead all UDP ports have to be blocked at the firewall. This is one of the disadvantages of 'Pass-by' mode. In contrast, in 'Pass-through' mode all Internet traffic passes through WFilter's network bridge and thus WFilter can block all traffic directly as required.

 

Usage

U-1. Why is QQ's password needed to see QQ's chat content?

Because QQ's messages are encrypted. The QQ client will get a session key to encrypt the whole conversation at login. And the session key can only be decrypted by QQ's password. You have two options:

U-2. How to block tencent QQ?

In 'Pass through' mode just block QQ in WFilter. In 'Pass by' mode, first you need to block UDP ports 8000,8001 at your gateway. Then you need to  block QQ in WFilter.

U-3. Can I select the computers that I wish to monitor (rather than all the computers)?

Yes. You can use the monitor checkbox in the "User-computer Table" to select which computers that you wish to monitor.

U-4. How can I determine the owner's name of a computer

By clicking on the IP address in the "User-computer Table", you can see detailed information about the computer (computer name, group name,mac address, ip address and so on). If you still cannot determine who is using the computer, you can take a look at its chat record or email records which will give you more information.

U-5. How do I identify a computer's MAC address?

The MAC address is the NIC's physical address. At the computer of interest click: "Start"->"run", type "cmd" then press ENTER. Type "ipconfig /all" in the command window, and you will see the "Physical Address".

U-6. How do I configure the firewall to allow WFilter to operate?

There are three programs that need to access the network: webservd.exe, startsys.exe and cgiproj.exe. You need to allow these programs in the firewall.

U-7. How do I change WFilter's listening port?

By default, WFilter listens on ports 9090 and 9091. You can change the ports by modifying the LanMonitor.cfg file. LanMonitor.cfg is located in the config directory of WFilter's installation directory. (Default:c:\program files\IMFirewall\WFilter)

After WFilter is listening on the new ports. You should update the target of WFilter shortcuts to the new port.(Default: http://localhost:9090)

U-8. Can WFilter monitor e-mails received and sent by a web browser?

Reading and sending web based email is just like monitoring web surfing and posting. Mails sent will be recorded in the "Post" category. But web based emails received will only record the page title like other web surfing.

U-9. Why can I only monitor messages sent but cannot monitor messages received?

This advice applies to WFilter in 'pass-by' mode. If you use a broadcasted hub, it may be because your hub's connection is incorrect. Make sure the port near the uplink port is unused. And please try another port if the problem still exists.

If you use a port mirror switch, make sure you have set your switch to monitor both incoming and outgoing traffic.

U-10. If I want to monitor more computers than I initially purchased, what should I do?

You can purchase more licenses, and you only need to pay for the additional licenses. We will provide you with a new serial number to increase the number of computers that can be monitored.