Network Profiler - Juniper NETWORK AND SECURITY MANAGER 2010.3 - CONFIGURING INTRUSION DETECTION AND PREVENTION GUIDE REV1 Manual

Table 10: Protocol Profiler Data (continued)
Column
Device

Network Profiler

Table 11: Network Profiler Data
Column Description
Src IP Source IP address of the traffic profiled.
Dst IP Destination IP address of the traffic profiled.
User The user associated with the traffic profiled.
Role The role group to which the user that is associated with the traffic profiled belongs.
Service All services of traffic profiled.
Access Type Type of the traffic profiled:
Src MAC Source MAC addresses of traffic profiled.
Copyright © 2010, Juniper Networks, Inc.
Description
Device through which the session was forwarded.
By default, the Protocol Profiler tab contains only the data collected during the configured
time interval.
To display the Protocol Profiler tab:
In the NSM navigation tree, select Investigate > Security Monitor > Profiler.
1.
Click the Protocol Profiler tab.
2.
TIP: For information about using NSM features to sort, filter, and drill down in records,
see the NSM online Help.
The Network Profiler view is a table of information such as the NSM Log Viewer which
enables you to view and analyze data related to static traffic (Layer-3, Layer-4, and RPC
protocols, ports, and program numbers) within the context of data corresponding to
peer, host, and operating system.
Table 11 on page 23 describes Network Profiler data.
Access indicates a successful connection, during which the device recorded valid requests and
responses from the server to a client.
Attempt indicates a request that did not receive a reply. The device recorded a packet from a client
to a server, but never saw a reply.
Probe indicates a request that does not expect a reply. For non-TCP sessions, the device recorded
an ICMP error; for TCP sessions, the device recorded a SYN packet from the client followed by a
RST from the server.
Chapter 3: Configuring Profiler Settings
23