Network Policy Engine

This document provides details on how to use the Netify DPI Network Policies Engine to identify Layer 7 application/protocol traffic using native Layer 3 network tools.

The Netify Network Policy Engine makes it possible to to use a wide variety existing Linux tools to manage and identify Layer 7 network traffic:

• tc - traffic control
• ip rule - multiWAN routing policies
• iptables/nftables - firewalling and audit trails
• any custom tools using ipsets or firewall marks

The adjacent configuration shows two simple examples.

• Rule #1 - All streaming media detections (Netflix, YouTube, etc.) will be maintained in an IP set
• Rule #2 - All BitTorrent traffic will be marked with the specified mark

For quick reference, you can find the tags (e.g. streaming-media and bittorrent in the example configuration) used in the detection rules here:

• Applications
• Application Categories
• Protocols
• Protocol Categories

{
  "version": "1.0",
  "rules": [
    {
        "type": "ipset",
        "application_category": "streaming-media"
    },
    {
        "type": "mark",
        "protocol": "bittorrent",
        "mark": 3
    },
  ]
}