McAfee Data Loss Prevention 9.2.2 Product Guide

Managing McAfee DLP systemsUsing capture filters 13Table 13-2 Standard network capture filtersNetwork capture filter PurposeIgnore RFC 1918 Excludes traffic routed to 10.0.0.0.‐10.255.255.255,172.16.0.0.‐172.31.255.255 and 192.168.0.0‐192.168.255.255Ignore HTTP ResponsesIgnore unknownIgnore SMBIgnore SSHIgnore POPIgnore IMAPIgnore HTTPSIgnore LDAPIgnore NTLMBASEExcludes program output sent from a server after receiving andinterpreting an HTTP RequestExcludes traffic using unknown protocolsExcludes Session Message Block and Microsoft Basic Input/Output System(NetBIOS) trafficExcludes Secure Shell trafficExcludes Post Office Protocol 3 trafficExcludes Internet Message Access Protocol trafficExcludes secure Hypertext Transport Protocol trafficExcludes Lightweight Directory Access Protocol trafficExcludes Microsoft New Technology Local Area Network Manager trafficBase Configuration filter (opens the system for storage of incoming data)Types of capture filtersCapture filter types are determined by the layer of the OSI (Open Systems Interconnection) modelthat is recognized and stored by the capture database.There are two capture filter types.• Content capture filters filter out specific content types, eliminating significant portions of Applicationlayer data• Network capture filters filter out or store network traffic on the Transport Layer, usually in a specificsequence.Content capture filters are used to streamline data capture and improve performance. Networkcapture filters can be used to do more complex tasks, like finding spiders, robots, crawlers, types ofwebmail, browser versions, and operating systems in use.Types of capture filter actionsCapture filter actions exclude or store large amounts of captured data. The actions available differ,depending on whether the filter is designed to work on the Application or Transport layer.There are two capture filter action types, and several sub‐types that extend the functionality ofcontent and network capture filters.Content capture filters allow administrators to configure the capture engine to drop elements, sessions orstore element only metadata.For example, if your network has a large cache of video files that you know are not a security threatbecause you have controlled them with configuration management software, you can set up a filter thatdrops those elements, saving time and resources for analysis of data at risk. Similarly, if youremployees are authorized to send or receive any SMTP content that is processed by your company'smail server, you can drop those communications.Network capture filters allow administrators to configure the capture engine to ignore or store traffic types.For example, if you want to know what kind of data is moving through the network data stream withoutstoring its content, storing metadata allows you to keep incidental information (like the source anddestination of the data, data types being transmitted, and protocols being used to transmit it).McAfee Data Loss Prevention 9.2.2 Product Guide 253