i
Contents
1 Introduction to Network Traffic Analyzer ················································································································ 1
NTA data source overview ·············································································································································· 1
NTA and network flow record collection overview ······································································································· 3
NTA and network flow record processing overview ····································································································· 5
NTA server configuration ········································································································································ 5
Traffic analysis task management ··························································································································· 5
Application, protocol, and application category management ·········································································· 6
Filtering strategies ···················································································································································· 7
NTA parameter settings ··········································································································································· 7
Network behavior anomaly detection ···························································································································· 8
NTA widgets ······································································································································································ 9
Analyzing the network traffic between virtual machines ··························································································· 10
2 Configuring NTA for traffic analysis and auditing ······························································································ 11
Managing NTA data sources ······································································································································· 11
Device management ············································································································································· 12
Probe management ··············································································································································· 19
Managing NTA servers ················································································································································· 22
Viewing the NTA server list ·································································································································· 22
Viewing the NTA server details page ················································································································· 23
Modifying an NTA server configuration ············································································································· 24
Redeploying the NTA server configuration ········································································································ 26
Capturing an NTA server flux log ······················································································································· 26
Managing applications in NTA ···································································································································· 27
Managing applications ········································································································································ 28
Managing protocols ·············································································································································· 35
Managing application categories ······················································································································· 38
Viewing the application category list ·················································································································· 39
Querying the application category list················································································································ 40
Adding an application category ························································································································· 40
Modifying an application category ····················································································································· 42
Deleting an application category ························································································································ 43
Configuring NTA traffic analysis parameters ············································································································· 44
Basic and advanced settings ································································································································ 44
Using NTA filtering strategies ······································································································································· 46
Viewing the filter strategy list ······························································································································· 47
Viewing the filter condition list ····························································································································· 47
Adding a filter strategy ········································································································································· 48
Modifying a filter strategy ···································································································································· 50
Deleting a filter strategy ········································································································································ 53
Database space management ······································································································································ 53
Viewing current disk space usage statistics ········································································································ 53
Viewing database usage trend statistics ············································································································· 54
Data export ····································································································································································· 54
Viewing the data export config list ······················································································································ 55
Querying the data export logs ····························································································································· 55
Modifying the data export configuration ············································································································ 56
Auditing the exported data ·································································································································· 56
Anomaly detection management ·································································································································· 56
