Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 769 / 1026

Table 86: Network Profiler Data (continued)
Description Column
Destination OUIs of traffic profiled. Dst OUI
Operating-system version running on the source IP of the traffic profiled. Src OS Name
Operating-system version running on the destination IP of the traffic profiled. Dst OS Name
Number of occurrences that match the traffic profiled. Hits
Timestamp for the first time the device logged the event (within the specified
time interval). First Time
Timestamp for the last time the device logged the event (within the specified
time interval). Last Time
Domain in which the device is managed in NSM. Domain
Device that profiled the data displayed. Device
About the Violation Viewer
The Violation Viewer is similar to the Network Profiler view. The Violation Viewer displays
the same data that you can view in the Network Profiler view, but only for those object
entries that do not match specific address and service criteria. By creating specific
permitted objects, you can configure the Violation Viewer to display only those items
that violate the criteria that you set.
Configuring Permitted Objects
Permitted objects are shared objects specific to the Profiler. They enable you to configure
objects in the Profiler containing simple rules, consisting only of source IP, destination
IP, and service. The implied action is “permit” . You can then use the object to define what
you should see on the network—as opposed to an attack object, which defines what you
do not want to see as a set of rules. After you have created your permitted objects, the
Violation Viewer displays all traffic that does not match the criteria that you have
configured in these objects.
NOTE: In previous versions of IDP Manager, permitted objects were called
violation objects.
Example: Using the Violation Viewer to Detect Traffic That Uses Nonstandard Ports
The Profiler can help you confirm suspected violations such as SQL servers running on
the network. Most of the time, however, you do not know exactly what you are looking
for on the network. In these cases, it is easier to specify exactly what should be on the
network, then detect any traffic that violates that specification.
719 Copyright © 2010, Juniper Networks, Inc.
Chapter 18: Analyzing Your Network