Application Traffic

Function

If application-layer traffic anomalies or attacks occur, you can view the Application Traffic report to learn about application-layer traffic information. Application Traffic collects statistics on application-layer protocol traffic and provides two types of reports: Traffic Comparison and Traffic Distribution.

• Traffic Comparison

  Compares the Incoming Traffic, Outgoing Traffic, and Attack Traffic of specified Zones in different time range granularities in the report. You can compare the traffic information of different applications based on service types.

  You can use Traffic Comparison to view the Zones or destination IP addresses under attacks, comparison of inbound and outbound traffic, as well as the volume of attack traffic.

• Traffic Distribution

  Displays the service distribution of Incoming Traffic, Outgoing Traffic and Attack Traffic of the specified Zones in different time range granularities in the report.

  You can use Traffic Distribution to view the protocol distribution of specific Zones or destination IP addresses to determine whether to enable attack defense for a certain type of traffic.

Parameter

To query comparison between incoming and outgoing application traffic, set Report Type to Traffic Comparison. (For parameters, see Table 1.) To query traffic distribution of all types of applications, set Report Type to Traffic Distribution. (For parameters, see Table 2.)

Table 1 Parameters for querying traffic comparison

Parameter	Description
Device	Select an device from the drop-down list.
Zone	Click , select a Zone on the Zone page that is displayed, and then click OK.
Service	Includes four application-layer protocols HTTP, HTTPS, UDP_DNS, and SIP.
IP Address	Enter the destination IP address. Both IPv4 and IPv6 addresses are applicable. Traffic destined for the IP address is queried.
Time	Click to select the start time and end time of statistics. Or you can change the time values in corresponding text boxes. The end time should be later than the start time and the interval cannot be longer than one year. If the query interval is longer than or equal to seven days and shorter than one year, statistics are collected daily. If the query interval is longer than or equal to one day and shorter than seven days, statistics are collected hourly. If the query interval is shorter than one day, statistics are collected every five minutes.
Unit	Select a traffic measurement unit. The unit can be pps, qps, or kbps. The default unit is pps.

Table 2 Parameters for querying traffic distribution

Parameter	Description
Device	Select an device from the drop-down list.
Zone	Click , select a Zone on the Zone page that is displayed, and then click OK.
IP Address	Enter a destination IP address, for which the traffic is destined.
Time	Click to select the start time and end time of statistics. Or you can change the time values in corresponding text boxes. The end time must be later than the start time and the interval cannot be longer than one year. If the query interval is longer than or equal to seven days and shorter than one year, statistics are collected daily. If the query interval is longer than or equal to one day and shorter than seven days, statistics are collected hourly. If the query interval is shorter than one day, statistics are collected every five minutes.
Traffic type	Select a traffic type. Incoming traffic: queries the distribution of all types of applications in incoming traffic. Attack traffic: queries the distribution of all types of applications in attack traffic. Outgoing traffic: queries the distribution of all types of applications in outgoing traffic.
Unit	Select a traffic measurement unit. The unit can be pps or kbps. The default unit is pps.

Example

Figure 1 Comparison between incoming and outgoing application traffic

Figure 2 Traffic Distribution