Host Traffic Monitoring in U-Center  5.0

Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Document version: 5W100-20250827

 

Contents

Introduction· 1

Usage guidelines· 2

Prerequisites· 2

Restrictions and guidelines· 2

Example: Configuring NetStream·· 3

Network configuration· 3

Configuring the switch· 3

Configuring U-Center 5.0· 4

Adding devices· 4

Managing parameters· 5

Adding a threshold template· 5

Adding a host traffic analysis task· 6

Verifying the configuration· 9

Viewing host traffic analysis data· 9

 

Introduction

U-Center 5.0 allows administrators to group specific hosts together for traffic statistics and analysis, enabling efficient network planning and management.

 

Usage guidelines

Prerequisites

·     Install and deploy Unified Platform, U-Center 5.0 UCP, NTA, and NSM components.

·     Devices such as routers and switches support the NetStream and NetFlow log sending function.

·     Make sure the devices can communicate with the system.

·     Configure the SNMP community string and port number correctly on the device.

Restrictions and guidelines

·     When you add a host traffic analysis task, make sure the task includes at least one host.

·     If you specify an interface in the task, the traffic analysis task will generate statistics based on the traffic logs of the specified interface. If you do not specify an interface, it will generate statistics based on the traffic logs of all interfaces.

·     The deployment nodes and traffic reporting nodes for the NTA component match those of the UCP component.

·     The NTA device configuration varies by UCP deployment scenario.

¡     Full node deployment: UCP is deployed on all relevant nodes. In this case, you can configure a northbound IP address for all devices to enable comprehensive traffic monitoring and management, facilitating traffic analysis by the NTA component.

¡     Single-node deployment: UCP is deployed on one node only. In this case, due to the impact of UCP tags, only the IP address for that specific node can be configured.

 

Example: Configuring NetStream

Network configuration

As shown in Figure 1, a company uses the H3C S5800-32C switch as the core switch, with interface GE2/0/1 connecting to the external network and interface GE2/0/3 connecting to the U-Center 5.0 server. The IP address of the U-Center 5.0 server is 192.167.243.78/24. The switch uploads traffic information statistics to U-Center 5.0, allowing for monitoring of traffic across the entire network.

The server and device version information is as follows:

·     Unified Platform versions: UDTP (E7103), BMP (E7103)

·     U-Center versions: NTA (E7102), UCP (E7102), NSM_Res (E7102)

·     Switch software version: H3C Comware Platform Software, Software Version 5.20, Release 1809P11

Figure 1 Network diagram

 

Configuring the switch

# Enable NetStream for incoming traffic on GE2/0/1.

<H3C5800>system-view

[H3C5800]interface GigabitEthernet2/0/1

[H3C5800-GigabitEthernet2/0/1]ip netstream inbound

[H3C5800-GigabitEthernet2/0/1]quit

# Specify the U-Center 5.0 server as the destination host for NetStream data export.

[H3C5800]ip netstream export host 192.167.243.78 9020

By default, NetStream traditional data export uses the version 5 format. To use the version 9 format, execute the ip netstream export version 9 command in system view.

# Set the aging timer to 1 minute for active flows.

[H3C5800]ip netstream timeout active 1

# Set the aging timer to 10 seconds for inactive flows.

[H3C5800]ip netstream timeout inactive 10

# Specify GigabitEthernet 2/0/1 as the source interface for NetStream traditional data packets.

[H3C5800]ip netstream export source interface GigabitEthernet2/0/1

Configuring U-Center 5.0

Adding devices

1.     Log in to U-Center 5.0. Click the Monitor tab. From the left navigation pane, select Network Traffic Monitor > Traffic Configuration.

2.     Click the Device Management link.

3.     Click Add. The Add Device page opens, as shown in Figure 2.

Figure 2 Adding devices

 

4.     You can add devices in either of the following methods:

¡     Manually add a device: Enter the IP address and device name, and click Select Parameter Template to select or add a parameter template. In this example, a device is added manually. The IP address is 192.167.1.133, and the device name is Switch133.

¡     Select devices from the list: Click Select Device to select devices.

5.     Device Description: Enter a description. In this example, no description is entered.

6.     SNMP Parameters: Click Select Parameter Template to select or add an SNMP template. In this example, SNMP template SNMPv2c_Config_Template is selected.

7.     NetStream Flow Identifier: This option is enabled by default. In this example, the default is used.

8.     NetStream New Feature: This option is enabled by default. In this example, the default is used.

9.     Click OK to add the device.

Managing parameters

1.     Click the Monitor tab. From the left navigation pane, select Network Traffic Monitor > Traffic Configuration.

2.     Click the Parameters link.

3.     On the page, you can enable related features and configure traffic data settings. In this example, threshold alarming and baseline analysis are enabled, as shown Figure 3.

Figure 3 Enabling features

 

4.     After you enable a feature, click OK to save the configuration.

Adding a threshold template

1.     Click the Monitor tab. From the left navigation pane, select Network Traffic Monitor > Traffic Configuration.

2.     Click the Threshold Templates link.

3.     Click Add to access the page for adding a threshold template, as shown Figure 4.

Figure 4 Adding a threshold template

 

4.     Configure the following basic information:

¡     Template Name: Enter Host.

¡     Template Type: Select a template type. In this example, Host Task is selected.

¡     Use the default settings for the other parameters.

5.     Configure threshold settings:

¡     Traffic Threshold (Unit): Select a traffic unit. In this example, Mbps is selected.

¡     Alarm Settings: Select an alarm level, and set the traffic thresholds and the number of occurrences.

¡     Use the default settings for the other parameters.

6.     Click OK.

Adding a host traffic analysis task

1.     Click the Monitor tab. From the left navigation pane, select Network Traffic Monitor > Host Traffic.

2.     On the Host Traffic page, click Add to add a host traffic analysis task, as shown in Figure 5.

Figure 5 Adding a host traffic analysis task

 

3.     Configure the following basic information:

¡     Name: Enter HostA.

¡     Threshold Alarming: Enable this option. The Threshold Template field is displayed.

¡     Threshold Template: Click Select Threshold Template, and select an existing template or click Add to add a template.

¡     Baseline Analysis: Enable this option. The Automatic Baseline Anomaly Detection option and the Baseline Threshold Settings area are displayed.

¡     Automatic Baseline Anomaly Detection: Do not enable this option.

¡     Host IP: Enter 192.167.0.0/16, and then click Add to add it to the host IP list.

4.     Configure baseline threshold settings:

¡     Incoming Traffic Threshold: Enter 30%.

¡     Outgoing Traffic Threshold: Enter 30%.

5.     Configure application information: Click Select Applications, and select the applications to be monitored on the window that opens. Use the default settings for the other parameters.

6.     Configure interface information: Click Select Interfaces, and select GigabitEthernet2/0/1. Use the default settings for the other parameters.

7.     Click OK to add the host traffic analysis task, as shown Figure 6.

Figure 6 Host traffic analysis task list

 

Verifying the configuration

Viewing host traffic analysis data

1.     Click the Monitor tab. From the left navigation pane, select Network Traffic Monitor > Host Traffic. On the page, you can view traffic information about each host, including the alarm state, inbound traffic size, outbound traffic size, inbound traffic rate, and outbound traffic rate.

2.     Click the HostA link to view its traffic analysis information. The Traffic tab is displayed by default, as shown in Figure 7.

Figure 7 Traffic analysis report for HostA

 

3.     Click the Application tab to view the application analysis report for HostA, as shown in Figure 8.

Figure 8 Application analysis report for HostA

 

4.     Click the Source tab to view the source host analysis report for HostA, as shown in Figure 9.

Figure 9 Source host analysis report for HostA

 

5.     Click the Destination tab to view the destination host analysis report for HostA, as shown in Figure 10.

Figure 10 Destination host analysis report for HostA

 

6.     Click the Session tab to view the session analysis report for HostA, as shown in Figure 11.

Figure 11 Session analysis report for HostA