Table of Contents
Advertisement
Table 86: Network Profiler Data (continued)
Column
Description
Dst OUI
Destination OUIs of traffic profiled.
Src OS Name
Operating-system version running on the source IP of the traffic profiled.
Dst OS Name
Operating-system version running on the destination IP of the traffic profiled.
Hits
Number of occurrences that match the traffic profiled.
First Time
Timestamp for the first time the device logged the event (within the specified
time interval).
Last Time
Timestamp for the last time the device logged the event (within the specified
time interval).
Domain
Domain in which the device is managed in NSM.
Device
Device that profiled the data displayed.
About the Violation Viewer
Copyright © 2010, Juniper Networks, Inc.
The Violation Viewer is similar to the Network Profiler view. The Violation Viewer displays
the same data that you can view in the Network Profiler view, but only for those object
entries that do not match specific address and service criteria. By creating specific
permitted objects, you can configure the Violation Viewer to display only those items
that violate the criteria that you set.
Configuring Permitted Objects
Permitted objects are shared objects specific to the Profiler. They enable you to configure
objects in the Profiler containing simple rules, consisting only of source IP, destination
IP, and service. The implied action is "permit" . You can then use the object to define what
you should see on the network—as opposed to an attack object, which defines what you
do not want to see as a set of rules. After you have created your permitted objects, the
Violation Viewer displays all traffic that does not match the criteria that you have
configured in these objects.
NOTE: In previous versions of IDP Manager, permitted objects were called
violation objects.
Example: Using the Violation Viewer to Detect Traffic That Uses Nonstandard Ports
The Profiler can help you confirm suspected violations such as SQL servers running on
the network. Most of the time, however, you do not know exactly what you are looking
for on the network. In these cases, it is easier to specify exactly what should be on the
network, then detect any traffic that violates that specification.
Chapter 18: Analyzing Your Network
719
Advertisement
Table of Contents
