H3C Technologies H3C Intelligent Management Center - Manual (Page 38)

28
The following information describes the process for managing applications, protocols, and application
categories in NTA.
Managing applications
NTA analyzes traffic from an application perspective based on the list of applications within NTA. NTA
enables you to add custom applications to the list that NTA uses to process and analyze and present
network flow data. This feature enables you to identify and analyze applications used by your
organization that are not included in NTA as system or predefined applications.
There are two types of applications, Layer 4 and Layer 7. With Layer 4 applications, you specify the
application name as well as the Layer 4 protocol in use, TCP, UDP, or both. In addition, you specify the
Layer 4 port number that the application uses and the IP addresses of hosts that use the application.
Therefore, Layer 4 applications can be identified by host. When a match is found, NTA attributes the
traffic in NTA reports to the application name you provided.
With Layer 7 applications, content that can be found in the header of an IP packet is used to identify the
application. This feature is particularly useful for applications that use dynamic port assignments such
P2P, BT, and eDonkey. To create a Layer 7 application, you specify a regular expression string that NTA
uses to compare the contents of the IP header of every packet. When a match is found, NTA attributes the
traffic in NTA reports to the application name you provided. Applications using inconsistent ports are
common in most networks and processing them in NTA can consume considerable NTA system resources.
Therefore, Layer 7 applications include the option to enable or disable them. This enables you to create
the applications, and then use them on an as-needed basis.
The following information describes the process for viewing, adding, modifying, and removing
applications from NTA.
Viewing the application list
All of the applications that NTA uses to analyze and present network flow data from an application
perspective can be found in the Application List.
To view the application list:
1. From the top navigation bar, select Service > Traffic Analysis and Audit > Settings.
2. In the Settings area of the Traffic Analysis and Audit page, click the Application Management link.
3. In the upper left corner of the Application Management page, click the Application tab.
NTA displays all applications in the Application List in the main pane of the Application
Management page.
Application list contents
• Application—Contains the name of the application. This field is a link to the Application
Details page for more detailed information on the associated application.
• Protocol—Identifies the Layer 4 IP protocol, TCP or UDP, for the associated application.
• Port—Contains the TCP or UDP port number for the associated Layer 4 application. A Layer
7 application does not need specific port number. The port number could be a port number
or a port number range.
• Application Type—Identifies which layer of the seven Layer OSI Reference model at which this
application operates.
• Description—This field provides a description of the application.
• Pre-defined—Identifies whether or not the associated application is system or predefined or
user-defined. A value of Yes in this field indicates that the associated application is system or