Per-device filtering

IP mapping resolves a query to a subscriber. Some deployments need to go one step further and apply different settings to different devices behind that one subscriber — a child's tablet versus a parent's laptop on the same home connection, for example. Per-device filtering builds on top of the IP mapping; it does not replace it.

Device IDs

A device ID identifies a single device within a subscriber. It is written as a namespace (lowercase letters, digits, and dashes), a colon, and a value:

mac:000036001122
msisdn:12345678

The namespace says what kind of identifier the value is (a MAC address, a mobile subscriber number, and so on), so different identifier types cannot collide.

There are two ways a device ID reaches the filter:

• Session-bound device IDs. The device ID is attached to the IP mapping session itself. This fits networks where one session already corresponds to one device — mobile networks are the common case, where a subscriber's session maps to a specific handset. The device ID travels with the session from the data source, so the filter knows the device purely from the client IP.
• CPE-assisted EDNS attributes. On a shared connection the IP address alone cannot tell devices apart. If the customer-premises equipment (CPE) can identify the device, it can pass the device ID in the query's EDNS client parameters. The filter reads it from there and applies that device's settings.

Device profiles

Devices are grouped into device profiles, identified by a number. Profile 0 is the default profile, used when no specific device profile applies. A subscriber's settings can then differ per profile, so each group of devices gets its own filter behavior while sharing the one subscriber identity.

Proxies

Proxies are a special case. A proxy does not have access to the EDNS device attributes that the Recursor sees, so it cannot read a per-query device ID. Instead, the device profile is bound to the address the proxy listens on: a fixed profile number is associated with a listen address, and every query arriving there is treated as belonging to that profile. So where the Recursor picks a profile from the device ID in the query, a proxy picks it from the listen address the query arrived on.

To offer several profiles, operators expose one listen address per profile; the profile number then selects the right settings for that username.