Wanguard 6.2 User Guide
Reports » Components
Filter Clusters, Packet Filters, and Flow Filters
The tables are displayed while there is at least one active Filter Cluster, Packet Filter or Flow Filter.
Status
A green check mark indicates that the Filter is connected to Console. If you see a red “X”
instead, make sure that the WANsupervisor service is running and look for errors in the event
log (see page 69).
Filter Name
Displays the Filter and a colored square with the color defined in its configuration. Click to open
a new tab with data specific to the Filter. Administrators and operators can right-click to open
the Filter Configuration window.
Anomaly#
When a Filter instance is activated by a Response to mitigate an anomaly, the field contains the
link to the anomaly report.
Otherwise, the field contains the message “Filter offline”.
Prefix
IP address/mask of your network that is originating or being the target of the traffic anomaly.
Click to open a tab with data specific to the IP block or address.
IP Group
IP group of the prefix. Click to open a tab with data specific to the IP group.
Decoder
Decoder used for detecting the abnormal traffic.
Pkts/s
Packets/second throughput sent to the attacked prefix.
Bits/s
Bits/second throughput sent to the attacked prefix.
IPs (Ext.)
Unique IP addresses sending traffic to the attacked prefix.
Dropped
The rate of packets dropped by the packet capturing engine. A high number indicates a sniffing
performance problem.
Peak CPU%
Maximum percentage of CPU resources used by the Filter instance.
Peak RAM
The maximum amount of RAM used by the Filter instance.
Start Time
The time when the Filter instance started mitigating the anomaly.
Server
Which server runs the Filter instance. Click to open a new tab with data specific to the server.
Administrators and operators can right-click to open the Server Configuration window.
- 91 -
Summary of Contents for wanguard 6.2
Page 1: ......
