SevOne

SevOne

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Flow reporting | Unknown application label and custom application labels

    Posted 01/21/25 08:32 AM

    Hi all

    Our SevOne receives flows from a Cisco SD-WAN environment and there is a bandwidth intensive application that SevOne will report as Unknown. We know the application representing these flows going by the destination IP address and TCP port characteristics. But we would really like to enable SevOne to know the application name rather than reporting as Unknown.

    So far we have defined a custom application in NBAR that is running on the Cisco SD-WAN platform and the flow reporting within that platform correctly labels the traffic according to our custom application name.  How do we enable SevOne to also use this custom application name?

    Thanks


    #TechnicalQuery

    ------------------------------
    Greg Linforth
    ------------------------------


  • 2.  RE: Flow reporting | Unknown application label and custom application labels

    Posted 01/22/25 08:53 AM

    I think you can go to Administration -> Flow Configuration -> Apps and Protocols and define this application given you know the IP and Port.



    ------------------------------
    Dave Hegenbarth
    ------------------------------



  • 3.  RE: Flow reporting | Unknown application label and custom application labels

    Posted 01/23/25 11:50 PM

    Thanks Dave, if I understand correctly you have shared a view from 7.1. We are running an earlier version 6.8 which has a different navigation. The guide for 6.8 explains how to define new protocols and new services, but no reference to defining new applications. Would you think that the term "services" equates to an application?



    ------------------------------
    Greg Linforth
    ------------------------------

    Original Message


  • 4.  RE: Flow reporting | Unknown application label and custom application labels

    Posted 01/29/25 09:29 AM

    Hi Greg,

    In 6.8 apps are referred to as services.  In 7.0+ you will see a change where they are referred to as "apps".  You can add a new custom service (app) and then associate the ports and IP addresses of your systems to that service name.  You can also use an aggregation port (high port number e.g. (tcp/50000) to aggregate all traffic from various servers and ports to a single value -- useful if you want to get a picture of total volume across all service-related ports for that app.



    ------------------------------
    Tim Greenside
    Senior Global Solutions Architect
    IBM
    ------------------------------

    Original Message


  • 5.  RE: Flow reporting | Unknown application label and custom application labels

    Posted 01/29/25 10:58 PM

    Thanks Tim, very helpful! 



    ------------------------------
    Greg Linforth
    ------------------------------

    Original Message


Related Content