Traffic Filters on the Campus Network

Traffic within the campus network is filtered at selected points to block certain traffic:

• There are filters at the University's Internet border, restrictig traffic between the campus network and the Internet. See KB0010862: Secure Internet Border.

• OIT Filters Most IPv4 Broadcast and Multicast Traffic on Wireless Networks describes filters on the wireless networks operated by OIT Network Switching and Routing.

• OIT Filters mDNS (Multicast Domain Name Service) on Ethernet Networks describes filters on mDNS traffic. We filter the traffic as it tries to pass through the core of the campus network. We also filter the traffic as it tries to enter any of the wireless services provided by OIT Network Switching and Routing. These filters affect traffic within the campus network.

• OIT Filters IPv6 on Wireless Networks describes a filter on IPv6 traffic on the wireless networks operated by OIT Network Switching and Routing.

• OIT Filters AppleTalk on Wireless Networks describes a filter on the wireless networks operated by OIT Network Switching and Routing. AppleTalk is an obsolete protocol.

• At each IP router operated by OIT Network Switching and Routing, we filter traffic arriving at each of the router's network interfaces. We block incoming traffic coming from IPv4 source addresses other than that which are appropriate for the IP network to which that router interface is attached. This filter affects traffic as it tries to leave a subnet, for example.

• Some individuals, departments, and groups (including OIT groups other than OIT Network Switching and Routing) install firewalls and place some devices behind these firewalls. These firewalls filter selected traffic.

  As such firewalls are governed by persons or groups other than OIT Network Switching and Routing; we cannot document the filters they implement, or which parts of the portions of the campus network behind these firewalls. Such policies are governed by the individuals, departments, or groups responsible for these firewalls.

• At wireless access points operated by OIT Wireless Networking and Engineering, OIT attempts to filter the disruptive DHCP and BootP traffic sent by those wireless clients acting as rogue DHCP servers, rogue BootP servers, or rogue BootP Relay Agents. Only the disruptive DHCP and BootP traffic is filtered; the same wireless client's normal DHCP, BootP, and other traffic is not filtered.

• Networks built for specific applications or customers sometimes have traffic restrictions specified by the customer for whom the network was built. These vary per network, and are not documented here.