Classify a group of websites with similar domain names

Products

• PacketShaper

Issue/Introduction

I want to create classes that classify traffic from websites with similar domain names. For example, the website with the following domain name should get different priority:

com.my
com.sg
co.jp

Resolution

In the following example, an HTTP class is created. Child classes are then created with different domain names to further classify the traffic using the HTTP Criterion feature (Web:URL) in PacketShaper.

CLI:

class new /Inbound/HTTP COMMY nodefault inside host:any TCP service:Client outside host:any service:HTTP "Web:url:*.com.my*"

class rule add /Inbound/HTTP/COMMY inside host:any TCP service:HTTP "Web:url:*.com.my*" outside host:any service:Client

class new /Outbound/HTTP COMMY nodefault inside host:any TCP service:Client outside host:any service:HTTP "Web:url:*.com.my*"

class rule add /Outbound/HTTP/COMMY inside host:any TCP service:HTTP "Web:url:*.com.my*" outside host:any service:Client

 

class new /Inbound/HTTP COMSG nodefault inside host:any TCP service:Client outside host:any service:HTTP "Web:url:*.com.sg*"

class rule add /Inbound/HTTP/COMSG inside host:any TCP service:HTTP "Web:url:*.com.sg*" outside host:any service:Client

class new /Outbound/HTTP COMSG nodefault inside host:any TCP service:Client outside host:any service:HTTP "Web:url:*.com.sg*"

class rule add /Outbound/HTTP/COMSG inside host:any TCP service:HTTP "Web:url:*.com.sg*" outside host:any service:Client

 

A screenshot showing how it can be configured using the Legacy UI.

 

Notes:

• The asterisk (*) mark serves as a wildcard in this scenario, meaning if  ".com.sg" appears in any part of the web URL, it will be classified under the COMSG class.
• PacketWise examines only the first 128 bytes of the URL in a flow.
• Only one URL can be specified per matching rule.