Afp Overview - Alcatel-Lucent OmniSwitch 9900 Series Network Configuration Manual

Configuring Application Fingerprinting

AFP Overview

The OmniSwitch Application Fingerprinting (AFP) feature attempts to detect and identify remote
applications by scanning IP packets received on an AFP port and comparing the packet contents against
predefined bit patterns or signatures. Once the application is identified, the switch can collect the source
and destination information, apply QoS, or generate an SNMP Trap.
This feature is best utilized on server-facing ports where an administrator needs more detailed information
on the protocols running inside a device, or to make sure that certain QoS actions are automatically
applied wherever an application might run. By default, Application Fingerprinting is globally enabled for
the switch, but disabled on all switch ports and link aggregates.
Enabling Application Fingerprinting on a port or link aggregate triggers the sampling of IP packets on that
port or aggregate.
•
The sampled IP packets are compared against REGEX application signatures stored in the default
"app-regex.txt" file located in the "/flash/app-signature/" directory on the local switch.
•
When an application REGEX match occurs, the switch generates a multi-tuple classifier based on
information obtained from the matching application packets. This classifier is then stored into a local
database on the switch and is used to identify the application for further monitoring or action.
•
After the application is identified on a specific port, Application Fingerprinting monitors the
application traffic flow on that port. In addition, the switch may also apply QoS policy rules to the
application traffic flow, depending on the Application Fingerprint port configuration.
The following diagram provides a high-level example of the Application Fingerprinting process:
Application
Signatures
Update
Database
with Aging
REGEX
Pattern Matching
OmniSwitch AOS Release 8 Network Configuration Guide
Application
Fingerprinting
Process
Update Signatures
Packet Sampling
Application
Fingerprinting
Port
Packet
Matches
December 2017
AFP Overview
UNP
Policy Lists
QoS
Policy Lists
page 30-5