Symantec 10268947 - Network Security 7160, User Manual

Page: 84 / 134

84 Response Rules
Playing recorded traffic
Replaying recorded traffic flow data
The Network Security console provides a way to review recorded traffic data in
two ways: from the
Query button or from the Incidents tab on the main menu of
the Network Security console. The record of events is displayed as a table with
each row corresponding to one event. By selecting an event, you can display the
flow or delete the event. In the flow view, you can replay the details of the traffic
flow data.
To replay traffic flow data
1 Choose one of the following:
■
Click Flows > Traffic Playback > select a node > OK .
■
Click Incidents > double-click the Traffic Record Finished event >
Event Message .
Skip Steps 2 and 3, and proceed directly to Step 4.
2
In Traffic Playback Configuration , you can adjust the view as follows:
■
To adjust your view of Recorded Events , click Column .
■
To remove events you do not want to view, click the event, and then
click
Delete .
3 In Recorded Events , click the row corresponding to an event to view the
flow of that event in Flows of Selected Record .
4 In Flows of Selected Record , click a row corresponding to a flow, then click
Playback .
5 In Packet Replay Tool , view the detailed packet data, one packet at a time.
6 To view all packet data in a session that includes multiple packets, on
Symantec Packet Replay Tool , click View > Show Session Window .
7 Return to Symantec Packet Replay Tool , and click Go .
Note: SuperUsers can view playbacks of recorded traffic; Administrators,
StandardUsers, and RestrictedUsers cannot. See “User groups reference” on
page 319 for more about permissions.