Configuration Traffic Collection Scope

Download

フォーカスモード

フォントサイズ

最終更新日: 2026-07-08 16:53:19

Feature Overview
NDR supports customizing the traffic collection scope to ingest traffic from specified assets for NDR analysis.
Note:
Only CVM and container clusters support configuring the traffic collection scope.
Operation Steps
1. Log in to the CFW console, in the left sidebar, choose Network Detection and Response > Traffic Access.
2. On the Traffic Access page, click Traffic Collection Configuration.
3. On the Manage traffic collection scope page, click Create filter conditions to configure the traffic collection scope.
4. In the Create filter conditions dialog, fill in the basic information and rule configuration, click OK to save, and the traffic collection scope takes effect immediately.
Parameter Name
﻿
Parameter Description
Basic information
Name
Name of the traffic collection scope rule.
﻿
Application Assets
Select assets to which this rule applies from CVM assets and container cluster assets.
Rule Configuration
Priority
Assigned automatically based on policy type and cannot be edited manually. The priority for the exclusion policy is 0, for the collection policy is 1, and for the system fallback exclusion policy is 2. A smaller number indicates a higher priority.
﻿
Protocol
Supports TCP, UDP, and ICMP protocols. Selecting ALL means all are supported.
﻿
Access source
Only CIDR format is supported, for example: 10.0.0.0/16.
﻿
Source Port
The port range is 0~65535, and the following formats are supported:
All ports: -1/-1.
Single port: for example, 22.
Port range: for example, 80~88.
Multiple ports: for example, 22/80.
﻿
Access Destination
Only CIDR format is supported, for example: 10.0.0.0/16.
﻿
Destination  port
The port range is 0~65535, and the following formats are supported:
All ports: -1/-1.
Single port: for example, 22.
Port range: for example, 80~88.
Multiple ports: for example, 22/80.
﻿
Policy
The rule supports two policy types: collection and exclusion.
collect: Traffic that matches the policy is ingested into NDR for analysis.
exclude: Traffic that matches the policy is excluded from NDR analysis.
Note:
The system automatically provides a fallback exclude rule, which cannot be deleted or edited.
A maximum of 5 rule configurations are supported. The system's fallback exclusion rule is not counted towards the quota.
5. After the rule is saved, you can check whether the collection scope rule has taken effect in the CVM and container cluster asset list on the Network Detection and Response > Traffic Access page.
When no traffic collection scope is configured, the scope is displayed as Full Collection, and all inbound and outbound mirrored traffic is collected.
When a traffic collection scope is configured, the configured Traffic Collection Scope Rule Name is displayed. Traffic matches rules based on policy type priority. Click Rule Name to view details of the specific filter conditions.
﻿
﻿

ヘルプとサポート

この記事はお役に立ちましたか？

営業担当者にお問い合わせいただくかチケットを提出してサポートを求めることができます。

フィードバック

tencent cloud

Tencent Cloud Firewall

Configuration Traffic Collection Scope

Feature Overview

Operation Steps

ヘルプとサポート

Parameter Name			Parameter Description
Basic information	Name	Name of the traffic collection scope rule.
Basic information		Application Assets	Select assets to which this rule applies from CVM assets and container cluster assets.
Rule Configuration	Priority	Assigned automatically based on policy type and cannot be edited manually. The priority for the exclusion policy is 0, for the collection policy is 1, and for the system fallback exclusion policy is 2. A smaller number indicates a higher priority.
		Protocol	Supports TCP, UDP, and ICMP protocols. Selecting ALL means all are supported.
		Access source	Only CIDR format is supported, for example: `10.0.0.0/16`.
		Source Port	The port range is 0~65535, and the following formats are supported: All ports: `-1/-1`. Single port: for example, `22`. Port range: for example, `80~88`. Multiple ports: for example, `22/80`.
		Access Destination	Only CIDR format is supported, for example: `10.0.0.0/16`.
		Destination port	The port range is 0~65535, and the following formats are supported: All ports: `-1/-1`. Single port: for example, `22`. Port range: for example, `80~88`. Multiple ports: for example, `22/80`.
		Policy	The rule supports two policy types: collection and exclusion. collect: Traffic that matches the policy is ingested into NDR for analysis. exclude: Traffic that matches the policy is excluded from NDR analysis.