Application Traffic

Function

If application traffic anomalies or attacks occur, you can view the Application Traffic report to learn about application traffic information. The ATIC management center collects statistics on application-layer protocol traffic and user-defined service traffic and provides Traffic Comparison and Traffic Distribution reports. The supported application-layer protocols include HTTP, HTTPS, UDP_DNS, and SIP.

Traffic Comparison

Compares the Incoming Traffic, Outgoing Traffic, and Attack Traffic of specified Zones in different time range granularities in the report. You can compare the traffic information of different applications based on service types.

You can use Traffic Comparison to view the Zones or destination IP addresses under attacks, comparison of inbound and outbound traffic, as well as the volume of attack traffic.
Traffic Distribution

Displays the service distribution of Incoming Traffic and Attack Traffic of the specified Zones in different time range granularities in the report.

You can use Traffic Distribution to view the protocol distribution of specific Zones or destination IP addresses to determine whether to enable attack defense for a certain type of traffic.

Parameter

To query comparison between incoming and outgoing application traffic, set Report Type to Traffic Comparison. (For parameters, see Table 1.) To query traffic distribution of all types of applications, set Report Type to Traffic Distribution. (For parameters, see Table 2.)

**Table 1** Parameters for querying traffic comparison
Parameter	Description
Device	Select a device from the drop-down list.
Zone	Click , select a Zone on the Zone page that is displayed, and then click OK.
Service	Includes HTTP, HTTPS, UDP_DNS, and SIP.
IP Address	Enter the destination IP address. Both IPv4 and IPv6 addresses are applicable. Traffic destined for the IP address is queried.
Time	Click to select the start time and end time of statistics. Or you can change the time values in corresponding text boxes. The end time should be later than the start time and the interval cannot be longer than one year. If the query interval is longer than or equal to seven days and shorter than one year, statistics are collected daily. If the query interval is longer than or equal to one day and shorter than seven days, statistics are collected hourly. If the query interval is shorter than one day, statistics are collected every five minutes.
Unit	Select a traffic measurement unit. The unit can be pps, qps, or kbps. The default unit is pps.

**Table 2** Parameters for querying traffic distribution
Parameter	Description
Device	Select a device from the drop-down list.
Zone	Click , select a Zone on the Zone page that is displayed, and then click OK.
IP Address	Enter a destination IP address, for which the traffic is destined.
Time	Click to select the start time and end time of statistics. Or you can change the time values in corresponding text boxes. The end time must be later than the start time and the interval cannot be longer than one year. If the query interval is longer than or equal to seven days and shorter than one year, statistics are collected daily. If the query interval is longer than or equal to one day and shorter than seven days, statistics are collected hourly. If the query interval is shorter than one day, statistics are collected every five minutes.
Type	Select a traffic type. Incoming Traffic: queries the distribution of all types of applications in incoming traffic. Attack Traffic: queries the distribution of all types of applications in attack traffic. Outgoing traffic: queries the distribution of all types of applications in outgoing traffic.
Unit	Select a traffic measurement unit. The unit can be pps or kbps. The default unit is pps.

Example

When the report type is set to Traffic Comparison, the device is set to bj-Cleaning, the Zone is set to test1, and the service is set to HTTP, traffic comparison within a period of time is displayed in Figure 1.

Figure 1 Comparison between incoming and outgoing application traffic

When the report type is set to Traffic Distribution, the device is set to bj-Cleaning, the Zone is set to test1, and the service is set to Incoming traffic, traffic comparison within a period of time is displayed in Figure 2.

Figure 2 Traffic distribution

Procedure

Choose Report > Report > Traffic Analysis.
Click the Application Traffic tab.
Set query parameters.
Click Search.
Optional: Open or save the query results as files, or send queried reports to the specified email address.
- Click to open or save the query results as PDF files. A maximum of 10,000 entries can be displayed.
- Click to open or save the query results as EXCEL files. A maximum of 10,000 entries can be displayed.
- Click to open or save the query results as CSV files. All data except figures can be displayed.
- Click to enter a recipient mail address and select an attachment format. Then click OK.