Application Intelligence Session

Supported Devices : GigaVUE- HC1 Gen 2, GigaVUE- HC1 Gen 3, GigaVUE‑HC2,GigaVUE- HC3 Gen 2, GigaVUE- HC3 Gen 3 ,GigaVUE- HC1 Plus.

Refer to Supported GigaSMART Operations for more details on the devices that support GigaSMART operations.

Application Visualization (earlier known as Application Monitoring) gathers the application statistics, and sends this information to GigaVUE-FM, which acts as an application monitor. The monitoring reports are sent to GigaVUE-FM through the destination port 2056. The application statistics appear as an array of monitoring reports that provide application-usage data in an easy-to-read graphical interface. This provides you with greater insight and control over how your network is being used and what applications are utilizing the most resources. To perform Application Monitoring, you must create the required application intelligence sessions on the nodes managed by GigaVUE-FM.

The total applications participating in the network traffic are displayed in the Application Intelligence Dashboard. For more information about the dashboard, refer to the View the Application Intelligence Dashboard.

If the session configuration is unsuccessful, troubleshoot the error notified (refer to View the Health Status of a Solution). Click the Reapply all pending solutions button in the dashboard to redeploy the configuration.

Note:  GigaVUE-FM takes few minutes to display the application statistics.

You can also filter the traffic based on the applications. For more information, see Application Filtering Intelligence.

Fast Mode

The DPI engine provides a performance optimization functionality called “fast mode”. In this mode the performance (less CPU cycles) is increased by the use of light parsers for processing the HTTP and DNS traffic.This is supported only in GigaVUE HC Series.

Benefits of Fast Mode

o   This increases the performance of HTTP and DNS based protocols.
o   This reduces the memory utilization.

Limitations of Fast Mode

o   This affects the classification of applications over HTTP. Only limited applications based on HTTP can be classified.
o   This affects the attribute extraction. For example, only some attributes are extracted for the HTTP traffic and no attributes are extracted for the DNS traffic. When the fast mode is enabled, the FM automatically displays only the attributes that are supported.

Note:   In the protobook, you can check if a specific application supports the fast mode or not, by navigating to the Attributes tab of the specific application. If the Basic DPI Support field is yes, then the application supports the fast mode option.

Application Intelligence can also be configured for virtual environment, refer to Application Intelligence for more detailed information.

Reference: Legacy NetFlow to AMI application attributes Mapping

When migrating Legacy NetFlow (Gen2) IPFIX application attributes to AMI, use the following table to identify the corresponding AMI attributes.

Protocol

Legacy Netflow Attribute ( Gen 2 )

AMI Attribute ( Gen 3)

HTTP

URL

uri_raw_path

HTTP Response Code

code

User Agent

user_agent

Host

host

Method

method

Version

version

SSL

Certificate Issuer Common Name

certificate_issuer_cn

Certificate Subject Common Name

common_name

Certificate Issuer

certificate_dn_issuer

Certificate Subject

certificate_subject_cn

Certificate Valid Not Before

validity_not_before

Certificate Valid Not Before Text

Not applicable; this attribute is exported in ID format by "validity_not_before"

Certificate Valid Not After

validity_not_after

Certificate Valid Not After Text

Not applicable; this attribute is exported in ID format by "validity_not_after"

Certificate Serial Number

Not applicable; this attribute is exported in ID format by "serial_number"

Certificate Serial Number Text

serial_number

Certificate Subject Algorithm

Not applicable; this attribute is exported in text format by "certificate_subject_key_algo_oid"

Certificate Subject Algorithm Text

certificate_subject_key_algo_oid

Certificate Subject Key Size

certificate_subject_key_size

Certificate Subject Alternative Name

subject_alt_name

Server Name Indication

server_name

Server Version

server_hello_version

Server Version Text

Not applicable; this attribute is exported in ID format by "server_hello_version"

Server Cipher

cipher_suite_id

Server Cipher Text

Not applicable; this attribute is exported in ID format by "cipher_suite_id"

Server Compression Method

compression_method

Server Session ID

session_id

DNS

Additional Name

name

Additional Type

Not applicable; this attribute is exported in text format by "host_type"

Additional Type Text

host_type

Additional Class

host_class

Additional Class Text

Not applicable; this attribute is exported in ID format by "host_class"

Additional TTL

ttl

Additional RData

host

Additional RData Length

rdlength

AN Count

ancount

AR Count

arcount

Authority Name

name

Authority Type

Not applicable; this attribute is exported in text format by "host_type"

Authority Type Text

host_type

Authority Class

host_class

Authority Class Text

Not applicable; this attribute is exported in ID format by "host_class"

Authority TTL

ttl

Authority RData

host

Authority RData Length

rdlength

Bits Count

not supported

Identifier

transaction_id

NS Count

nscount

Op Code

opcode

Qd Count

qdcount

Query Class

class

Query Class Text

Not applicable; this attribute is exported in ID format by "class"

Query Name

query

Query Type

query_type

Query Type Text

Not applicable; this attribute is exported in ID format by "query_type"

Response Class

host_class

Response Class Text

Not applicable; this attribute is exported in ID format by "host_class"

Response Name

name

Response Type

host_type

Response Type Text

Not applicable; this attribute is exported in ID format by "host_type"

Response IPv4 Address Text

Not applicable; this attribute is exported in ID format by "host_addr"

Response RData

host

Response RData Length

rdlength

Response TTL

ttl

Response IPv4 Address

host_addr

Response IPv6 Address

host_addr6

Response IPv6 Address Text

Not applicable; this attribute is exported in ID format by "host_addr6".