Processing the captured packet in TrafMeter

There are three processing levels of the captured packet in TrafMeter: the Filterset Level, the Filter Level and the Rule Level.

The Rule Level

All of rule's conditions must be valid for the captured packet in order for it to satisfy the rule. This case is called "Rule Match" and this rule is called "Matched Rule".

The Filter Level

The TrafMeter Filter may include unlimited number of rules. At least one rule, listed in the filter, must satisfy the captured packet, in order to satisfy the filter. Processing the captured packet at the filter level starts from the first rule until Rule Match. If Matched Rule has the actions "Count" or "Count and Pass", the sent bytes counter or the received bytes counter will be increased by the total length of the current packet.

The Filterset Level

The captured packet will be processed by the filters included in the filterset, from the first filter until the last filter. The captured packet will be processed by the next filter, if:

• The captured packet has not satisfied at least one rule, listed in the filter
• The Matched Rule has the action "Count"

TrafMeter will stop processing the captured packet, if:

• The Matched Rule has the action "Pass" or "Count and Pass"
• The Matched Rule has the action "Deny". In this case, a firewall will block the captured packet (valid only in Active Capture Mode). The action "Deny" is similar to the action "Pass" in Passive Capture Mode.