No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

In real-time monitoring window can see flow, but can't see session

Publication Date:  2012-11-26 Views:  27 Downloads:  0
Issue Description
At the NIP console, in real-time monitoring window can see flow, but can't see session.
Alarm Information
None.
Handling Process
Use Sniffer software analysis the data of the switch port which connects IDS monitor port, confirm whether the IDS monitor port can monitor to the complete session. As long as it can monitor to the complete session, it can be displayed at console.
Root Cause
The session in NIP is TCP session, it can be displayed after monitored to have completed to shake hands for three times. Several situations may be unable to monitor the complete session:
1, when mirroring port in switch, only mirrored a single direction flow;
2, asymmetric routing environment, namely the return path does not consistent.
3, image data brings with VLAN TRUNK (802.1 Q) mark, at present some ports of NIP can't identify the data with 802.1Q mark.
Suggestions
None.

END