Difference between Application Control and Web Filter

[chaycock]

Both of these modules seem to do pretty close to the same thing, so what is the functional difference between the two? They both seem to monitor/block traffic based on categorization/classification, so why do we have two distinct modules instead of this being just a single module?

[sharrisonUK]

Both of these modules seem to do pretty close to the same thing

While they do rely on 'lists' they do quite different things...

About Application Control

About Web Filter

[chaycock]

Yes, I have read those pages, but in the end, both modules can be used to block traffic based on traffic category or type, so I'm not sure what the real difference is, that is what I am trying to understand.

[jcoffin]

Web Filter is port 80 and 443 only with matching based on IP, domain, or sub-domain. Application Control can scan any port and use regex for matching packet patterns.

[chaycock]

So it sounds like Application control can do everything Web Filter can and more...so why not just roll them into one?

[jcoehoorn]

Think of Web Filter as a specialized deep view into one specific application, where that application is HTTP.

So why have this be separate? A number of reasons. Web Filter is more efficient at what it does... looking at just specific ports, without having to run regex on packet contents (headers are usually enough), and with a much deeper view of it's particular kind of traffic. It also makes for an easier interface, since adding every possible web site as it's own "Application" to the Application Control app would quickly explode the number of items to manage in that app beyond what is manageable. Additionally, Web Filter allows you to put in your own URLs to Block or Pass, while user-editing of the Application Control matching rules is not encouraged.

[chaycock]

Thanks jcoehoorn, that explanation is exactly what I was looking for, much appreciated!