Number of TCP Connections

Prerequisites

You can view the number of new TCP connections by source IP address only after Top N TCP Source IP Addresses by New Connection is enabled. For details, see Top N Study.

Function

Number of TCP connections provides visibility into the number of new TCP connections and number of concurrent TCP connections by destination IP address. In normal cases, observe and record the number of new connections and that of concurrent connections of services in the report. If the number of new connections or the number of concurrent connections is greater than the normal value, capture packets for analyzing anomalies or attacks.

Parameter

**Table 1** Parameters for querying the connection number by destination IP address
Parameter	Description
Device	Select a cleaning device from the drop-down list. The Total-Cleaning indicates the number of connections on all cleaning devices.
IP Address	Enter the destination IP address. Both IPv4 and IPv6 addresses are applicable. The number of connections to the IP address is queried.
Time	Click to select the start time and end time of statistics. Or you can change the time values in corresponding text boxes. The end time should be later than the start time and the interval cannot be longer than one year. If the query interval is longer than or equal to seven days and shorter than one year, statistics are collected daily. If the query interval is longer than or equal to one day and shorter than seven days, statistics are collected hourly. If the query interval is shorter than one day, statistics are collected every five minutes.

Example

The device is Total-Cleaning. Figure 1 shows the new connection rate and the number of concurrent connections of destination IP addresses queried in a given period.

Figure 1 Number of new connections and concurrent connections by destination IP address

Procedure

Choose Report > Report > Traffic Analysis.
Click the Number of TCP Connections tab.
Enter query parameters.
Click Search.
The number of connections that meet the query conditions is displayed.

NOTE:
The queried number of TCP connections is the number of session connections after the TCP three-way handshake.
Optional: Open or save the query results as files, or send queried reports to the specified email address.
- Click to open or save the query results as PDF files. A maximum of 10,000 entries can be displayed.
- Click to open or save the query results as EXCEL files. A maximum of 10,000 entries can be displayed.
- Click to open or save the query results as CSV files. All data except figures can be displayed.
- Click to enter a recipient mail address and select an attachment format. Then click OK.