Table of Contents
Advertisement
DFL-M510
The left of this screen displays the current application information; the right of this screen dis-
plays the accumulated application information for Top N analyzing. The right part is the same as
the right part of real time traffic.
There are three tables: the common network protocol table; the EIM table; and the health check-
ing table. Select the radio button to display each table. The EIM table is the default.
C
N
OMMON
ETWORK
The common network protocol table shows the current status of each host. This table is a layer 4
table and network applications are monitored at the network port number. The common network
protocol contains HTTP, HTTPS, SMTP, FTP, TELNET, POP3, IRC, NNTP, and IMAP. If a host
is connecting to the Internet via the above ports, the table shows a check mark to indicate the host
is currently connecting.
H
C
EALTH
HECKING
The Health Checking table is a layer seven table. Instead of classifying the application pattern,
several packets that come from attacking tools can damage the host. Some of the packets are
assembled and stored in the file system and are detectable by anti-virus software. Some packets
try to get system authorized control and run as an operating system's administrator without stor-
ing to the file system. These packets are invisible to almost all anti-virus software, but detectable
by the DFL-M510. When those packets come from a host and are detected, the corresponding
field shows a check mark to indicate the host has health concern problems.
Health concern problems include network based worms, illegal agents, and tunnels. Network
based worms do not include common viruses, since they are easy to discover by standard virus
software.
Illegal agents include backdoors, trojans, spyware, and ad-ware.
82 -- Chapter 5: Real Time Monitor
P
ROTOCOL
Advertisement
Table of Contents
