Application Intelligence Field References

Enter a unique name for the Application Intelligence session.

(Optional) Enter a description for the session.

Select Physical to configure the session for GigaVUE HC Series devices.

Select the node on which you want to deploy the session.

Enables or disables Application Visualization (AppViz) for this session. Monitoring is enabled by default and can be disabled when not required to improve performance.

Displays the interval at which AppViz statistics are exported to GigaVUE-FM. The value is fixed at 300 seconds (5 minutes) and is not user-configurable from version 6.4 onwards.

When enabled, uses light parsers to increase DPI performance for HTTP and DNS. Only a limited set of HTTP attributes is supported and GigaVUE-FM automatically exposes only the supported attributes. Fast mode can be enabled or disabled only when creating a new session.

Select an existing GigaSMART group, or create a new group by specifying an Alias and selecting one or more engine ports in the Port List.

Configures the buffer size used by Application Session Filtering in the GigaSMART group.

Configures the buffer size used for exporting metadata in the GigaSMART group.

Associates a User Defined Applications profile with the session so that the DPI engine can classify proprietary or internal applications based on user-defined signatures.

Select IPv4 or IPv6 as the IP version for the AppViz export interface.

Configure the IP interface used to export application statistics. The destination IP address must use the same IP version as the selected interface.

Specifies the IP address of GigaVUE-FM (or other collector) that receives AppViz statistics. By default, the GigaVUE-FM management IP is displayed.

Select one or more network ports or port groups that provide the traffic to be monitored by the session. Ports already used as sources in intent-based orchestrated solutions are not listed.

Defines Layer 2–Layer 4 conditions for each Source Traffic block. For each rule, click Select Conditions, choose a qualifier (such as IP version, IP source/destination, VLAN, protocol, or port), set the value, and select Pass or Drop and Bidirectional or unidirectional.

Adds another L2–L4 rule to the current Source Traffic block.

Lists the applications chosen from Total Applications on the Application Intelligence dashboard for creating an AFI policy. You can select one or more applications.

Marks the selected application to be passed to the tool ports configured in the associated Destination Traffic Priority block.

Marks the selected application to be dropped at the tool ports configured in the associated Destination Traffic Priority block.

Represents a second-level AFI map that forwards filtered traffic to tool ports. You can configure up to five Destination Traffic Priorities per AFI solution and reorder them to change priority.

Select the tool ports or tool port groups that receive traffic for this Destination Traffic Priority. If the required port is not visible, use Port Editor to mark it as a Tool port.

Opens an inline editor to change the Type of a physical port to Tool, after which it appears in the tool port selection list.

When enabled for a Destination Traffic Priority, passes all applications that do not match any explicit AFI rules in that priority. No-rule-match traffic can be monitored using map rule counters.

Opens the advanced rule configuration for the selected Destination Traffic Priority, allowing you to define non-application criteria (for example IP, VLAN, DSCP, pattern match) that must be met before traffic is passed or dropped.

Adds another Destination Traffic Priority (second-level map). A maximum of five priorities can be configured per AFI instance.

Configures whether AFI maintains flow state and applies rules to both directions of a session. When disabled, each direction is treated independently. Enabled by default.

Configures the idle timeout for AFI sessions. The default is 15 seconds; the valid range is 10–120 seconds. Flows that remain silent beyond this interval are flushed.

Configures the number of initial packets that AFI buffers before applying filtering rules. The default is 20; the valid range is 3–20. Lower values may cause drops if more packets are needed for DPI classification.

Selects the transport protocols for which AFI maintains sessions. Options include TCP only, UDP only, TCP-UDP, TCP UDP and SCTP, and SCTP only. Traffic that does not match the selected protocol set is dropped unless explicitly handled elsewhere.

When enabled, allows you to mention the Packet Count. The Packet Count limits the number of packets passed per flow to a configurable value in the range 2–100. Useful when tools only need the first few packets, such as TLS handshakes.

For each advanced rule, select a qualifier from the drop-down list, such as DSCP, ERSPAN ID, EtherType, GRE Key, GTP-U TEID, IP Fragmentation, IP Version, IPv4 Source/Destination, IPv6 Source/Destination, MAC Source/Destination, MPLS Label, Port Source/Destination, TCP Control, VLAN, VN-Tag VIF IDs, VXLAN ID, or Pattern Match.

When Pattern Match is selected, choose String or Regex and provide the search pattern to match data in the packet payload.

Enter the value appropriate for the selected qualifier (for example VLAN ID, IP address, DSCP number, or string/regular expression pattern).

Lists the applications chosen from Total Applications on the Application Intelligence dashboard for exporting metadata.

For each selected application, enables you to select the attributes to be exported. Each exporter can export metadata for up to 256 applications, and up to 64 attributes per application.

Configures an alias for the metadata collector (for example Splunk, NDR-1).

Selects the IP interface on the Gigamon device that connects to the collector.

Specifies the IP address of the tool that receives exported records.

Selects a pre-defined tool template that defines applications, attributes, and export format, such as SplunkMetadataTemplate, SecurityPosture, RogueActivity, or UnmanagedAssets.

Specifies the source UDP port used by the exporter.

Specifies the UDP destination port on the collector. When the export format is CEF, the default is 514; when the format is NetFlow, the default is 2055.

Enables or disables processing of SNMP packets (UDP 161) on the exporter interface. All exporters sharing an IP interface must have SNMP configured consistently.

When enabled, exports the Application Name for all applications identified by the DPI engine. Requires AMI/SVP/ZTA license.

Limits application metadata export to the selected applications or protocols on this exporter. Packet attributes (Collects) are still exported for all applications unless traffic is filtered using AFI or flow maps.

Selects the export format: NetFlow or CEF.

For NetFlow format, selects the NetFlow/IPFIX version: v5, v9, or IPFIX (IPFIX is the default).

Configures how often template records are exported for IPFIX. The default is 60 seconds; the valid range is 1–216000 seconds.

Selects how network and application metadata are exported. Segregated exports separate records for network and application metadata. Cohesive exports a consolidated record comprising both. The default depends on the configured Flow Behavior (Unidirectional or Bidirectional).

Configures the interval for exporting interim records for long-lived flows. The default is 60 seconds; the valid range is 1–604800 seconds.

Enables export of Bytes and Packets counters and configures the counter width (32- or 64-bit). NetFlow v5 supports only 32-bit counters.

Enables export of IPv4 attributes such as Source Address, Destination Address, Protocol, DSCP, TOS, TTL, header length, payload length, and fragmentation details.

Enables export of IPv6 attributes such as Source Address, Destination Address, Next Header, Flow Label, Traffic Class, DSCP, and fragmentation details.

Enables export of transport-layer fields such as Source Port, Destination Port, TCP flags, TCP sequence and acknowledgment numbers, MSS, Aggregate Window Size, and Zero Window statistics.

Enables export of ICMP Type and Code for IPv4 and IPv6 ICMP traffic.

Enables export of Source MAC, Destination MAC, and ingress VLAN ID.

Enables export of System Uptime First, System Uptime Last, Flow Start, and Flow End timestamps.

Enables export of the flow end reason (for example TCP FIN, RST, or inactive timeout).

Controls when records are exported for TCP flows. Transaction End exports records as soon as TCP connections terminate; None exports records based only on inactive timeout.

Selects Unidirectional or Bidirectional flow behavior. In Unidirectional mode, one record is exported per direction. In Bidirectional mode, a single record is exported for both directions of a flow.

Configures the cache timeout for flows maintained in the AMI cache. The default is 300 seconds; the valid range is 1–604800 seconds.

Sets the maximum number of concurrent flows that can be tracked. Valid ranges depend on platform and generation; from 6.12 onwards, the maximum supported value is used as the default for new configurations.

When enabled, allows multiple values to be exported for attributes that can have more than one value (for example DNS host addresses). IPFIX supports up to five values per attribute; CEF has no limit.

When enabled, exports Source and Destination MAC and VLAN ID and treats flows with identical 5-tuples and different VLAN IDs as the same flow.

Configures a user-defined identifier in the range 0–255 that, combined with the GS engine slot, forms the 4-byte Observation Domain ID used by collectors to distinguish sessions.

Restricts the number of packets per session sent to the DPI engine to improve performance. Recommended values are between 20–50, since the first packets in a flow typically contain the most significant attributes.

When enabled (Gen3 only), exports minimum, maximum, and mean RTT and TCP loss bytes per export interval for supported protocols such as TCP, HTTP, SSH, TELNET, ICMP, and ICMPv6.