Investigating Traffic - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - REV1 Manual

Investigating Traffic

Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Unique Ports - Available only when viewing the Local Networks View.
•
Specifies the traffic layer as the number of ports in use. Options include:
Normal, Log, and 1/X.
To investigate traffic using TopN:
Click the Network Surveillance tab.
Select the desired view to display traffic activity.
Select the desired layer from the Layers box.
TopN changes to display the activity for the top five network objects based on the
selected layer.
Point your mouse to the colored horizontal bar that corresponds to the color of
traffic on your graph.
The area becomes highlighted and the following appears:
Value - Depending on the layer you have selected, can display number of
•
bytes, packets, hosts per interval, or unique ports for the most active networks
in the last 60 seconds.
Rate - Depending on the layer you have selected, can display the rate of
•
transfer for bytes, packets, hosts per interval, or unique ports for the most
active networks in the last 60 seconds.
Percent - Displays the percentage of network traffic the network object
•
produced in the last 60 seconds.
Network Location - Displays the physical location for the networks associated
•
with the TopN information and is derived from your asset map.
Click the horizontal bar to freeze the information.
Click the network location from the Network Location section.
Note: The chosen layer determines the information displayed in the TopN box.
For example: If you have selected Bytes/Second from the Layer box, TopN
displays the following:
STRM Users Guide
Investigating Traffic Using TopN 35