PacketSure is a network monitoring appliance that enables administrators to define policies controlling what types of traffic and data will be allowed in or out of their networks. It is typically deployed off a SPAN/TAP port, though inline deployments are also noted as supported. Management of the appliance is via an included Web-based GUI, which can be accessed from remote locations.

PacketSure includes a built-in, pre-defined collection of better than 140 signatures enabling it to recognize traffic and applications such as Hotmail, POP3/SMTP, multiple P2P applications (BitTorrent, Gnutella, FreeNet, etc.), FTP transfers, Instant Messaging (AIM, Google, ICQ, etc.), streaming media, and more. For many protocols, sub-rules exists--such as active vs. passive FTP transfers, or differentiating file vs. message exchanges in Yahoo! Messenger--allowing for more fine grained policy definitions. Administrators can customize these rules as they need or create custom rule definitions based on keywords or regular expression matches. Rules can be assigned based on IP addresses, Active Directory names or groups, and more; and triggered rules (identified traffic that matches the rule) can result in one of three actions: Logging the activity, blocking it (via the sending of TCP resets), or allowing it.

In addition to its ability to block signature-based traffic, PacketSure can also block Web sites via built-in Web-filtering controls (Web sites are classified into categories such as Education, Gambling, Games, Lifestyle, etc., and these categories can then be used as part of the rule specification described above for the logging or blocking of traffic); and can apply content analysis technology in an attempt to prevent the leakage of sensitive information. This latter capability, in particular, is made possible via the product's ability to scan files being transfered over the network and identify sensitive content via several potential methods, including:

- Identification of private healthcare and financial information via the occurrence of specific words or phrases; the vendor states that this capability can be activated by selecting a "couple of checkboxes"

- Analysis of outgoing E-mail, made possible via an included SMTP proxy with the ability to take actions including blocking questionable messages or quarantining them for further review

- Match content against data from an existing, company DB

- Match credit card numbers

- Match other data via an extended regular expression engine

Social Security number matches, credit card matches, and tools for the input of custom extended regular expression matches are included in the base PacketSure offerings; the others are add-on options.

New features in the latest release of PacketSure include a Central Management Server that enables the central administration/management of multiple PacketSure appliances; a "Data-At-Rest" component enabling the application of data policies to endpoints; support for the analysis of HTTPS (SSL) content; and support for Cisco's Web Cache Communication Protocol.

PacketSure is available now. Contact the vendor for further information.

product submission by EITPlanet Staff

E-Mail this page to a colleague
send info about PacketSure

Suggest a link
for the PacketSure fact sheet