Wanguard 6.2 User Guide
Reports » Components
Reports » Components » Sensors
Click on a Sensor name anywhere in Console to open a tab that contains Sensor-specific information. The tab
includes a few sub-tabs, located at the lower side of the window. All sub-tabs share the following common toolbar
fields:
●
Sensors
– Select the Sensors you are interested in, or select “All” to select all Sensors. Administrators
can restrict which Sensors are accessible by guest accounts.
●
Time Frame
– Select a predefined time frame, or select “Custom...” to enter a specific time interval.
Sensor Dashboard
The Sensor dashboard allows you to group the most relevant data collected by Sensors. The Sensor
dashboard configuration does not apply to a particular Sensor, so the changes you make are visible for other Sensor
dashboards as well. The operation of dashboards is described in the “Reports » Dashboards” chapter on page 98.
The configuration of Sensor widgets is outlined in the following paragraphs.
Sensor Graphs
This sub-tab allows you to view a variety of Sensor-related histograms for the selected Sensor(s):
●
Data Units
– Select one or more data units:
◦
Most Used
– Frequently-used data units.
◦
Packets –
Inbound packets/second (+ on Y-axis) and outbound packets/second (- on Y-axis).
◦
Bits –
Inbound bits/second (+ on Y-axis) and outbound bits/second (- on Y-axis).
◦
Applications
– Sensor can collect application-specific distribution data for HTTP, HTTPS, SMTP, POP3,
IMAP, SNMP, FTP, SSH, TELNET, SQL, NETBIOS, MS-DS, MS-RDP, DNS, ICMP, and OTHERS. The graphs
are updated when the Sensor configuration has the Top Generator parameter set to “Basic”.
◦
Bytes –
Bytes/second throughput.
◦
Internal
or
External IPs –
IP addresses that send or receive traffic. Internal and External IPs are hosts
inside and respectively outside the IP Zone. The Top Generator parameter from the Sensor
configuration enables or disables monitoring of External IPs. A spike in the Internal IPs graph usually
means that an IP class scan was performed against your IP blocks. A spike in the External IPs graph
usually means that you have received a spoofed attack.
◦
Received Frames –
For Packet Sensors, it represents the number of packets/s received before IP or
MAC validation. For Flow Sensors, it represents the number of flows/s received before IP or AS
validation.
◦
Dropped Frames –
For Packet Sensors, it represents the number of packets dropped by the packet
capturing engine. A high number indicates a sniffing performance problem. For Flow Sensors, it
represents the number of unaccounted flows. A high number indicates a wrong configuration of the
- 92 -
Summary of Contents for wanguard 6.2
Page 1: ......
