Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 771 / 1026

2.
Take appropriate measures to secure the network, for example:
• Investigate the source IP of the traffic and contact the user. If the traffic is legitimate,
you might need to add the service to your corporate security policy to allow it on
your network. You should also edit the permitted object to include the service so
you no longer see the service in the Violation view.
• Create a rule in your security policy that drops connections between your internal
network objects if the traffic uses a service that you do not allow on your network.
About the Application Profiler
The Application Profiler view is a table of information that allows you to view network
traffic information at the application and application group level. By default, this view
contains only the data collected during the configured time interval. You can also specify
filters to display only the data you want to view.
As the applications that are running on the network form a hierarchy, the volume of traffic
that is generated by individual applications or application groups can be added to provide
the aggregate traffic volume information from the parent application group. As you move
up the root of the application hierarchy, you can view the total network traffic volume.
The Application Profiler view is divided into two sections: on the left panel, the hierarchical
application view displays a tree of the application categories with volume information
(in bytes and packets); on the right panel the application session view displays the
application name and the aggregated bytes and packets for the application. You can
expand the application name to see latest session data for that application.
Table 87 on page 721 lists and describes the information that you can view using the
Protocol Profiler:
Table 87: Applciation Profiler Data
Description Column
Source IP address of the traffic profiled. Src IP
Destination IP address of the traffic profiled. Dst IP
VLAN ID associated with the traffic profiled. VLAN ID
Application ID associated with the traffic profiled. Application
Byte count for the traffic profiled. Byte Count
Packet count for the traffic profiled Packet Count
The user login name. User
The role group to which the user that is associated with the traffic profiled
belongs. Role
721 Copyright © 2010, Juniper Networks, Inc.
Chapter 18: Analyzing Your Network