No relevant resource is found in the selected language.

# eSight V300R010C00SPC200, 300, and 500 Operation Guide 09

Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
FAQs

# FAQs

## How Do I View the Traffic Stacked Area Chart on the Traffic Analysis Page

### Question

How do I view the traffic stacked area chart on the traffic analysis page?

Figure 12-69 Application traffic stacked area chart

The stacked area chart is a special area chart used to compare multiple objects within a time range. It stacks multiple data series and displays the change trend of each value. The start point of each data series is drawn based on the previous data series. That is, the area of the second statistical object is drawn from the upper edge of the first object. For example, in the figure, the green area at the bottom indicates the application HTTP and the blue area indicates the SFTP. The blue area is drawn from the upper edge of the green area. You can intuitively analyze the whole-part relationship of each variable and view the percentage of each type of traffic to the top traffic.

In the table, the conversion relationships between packet units are as follows:

1 K = 1000

1 M = 1000 K

1 G = 1000 M

1 T= 1000 G

The conversion relationships between traffic units are as follows:

1 KB = 1024 B

1 MB = 1024 KB

1 GB = 1024 MB

1 TB = 1024 GB

## What Is the Algorithm of Interface or Interface Group Usage on the Flow Analysis Page

### Question

What is the algorithm of interface or interface group usage on the flow analysis page?

• Interface usage = The actual rate of interface/rate defined by interface configuration page
• Interface group usage = sum of the actual rate of interface/sum of all interface of group defined rate

## How Do I Set a Sampling Ratio for an Interface on eSight

### Question

How do I set a sampling ratio for an interface on eSight?

After you set a sampling ratio for an interface on the device, you need to perform the same configuration on eSight. For example, after you set the sampling ratio of an interface to 10 on the device, you need to log in to the Interface Configuration page on eSight, modify interface parameters, and set the sampling ratio of the same interface to 10.

## What Sampling Ratio Is the Most Appropriate

### Question

What sampling ratio is the most appropriate?

In most cases, you can use the default sampling ratio of devices, for example, 1000 for switches. However, you are advised to set the sampling ratio to 1 when the device traffic is small. When the sampling ratio is set to 1, traffic collection is the most accurate.

## Why the Inbound Or Outbound Interface Is Displayed as Unknown in the Traffic Forensics Result

### Question

Why the inbound or outbound interface is displayed as unknown in the traffic forensics result?

The inbound or outbound interface of packets is not monitored by eSight NTA or the packets are broadcast packets with the interface ID 0.

## Why Is the Traffic Statistics Value on eSight Zero

### Question

Traffic is collected by host or session group. The traffic value is displayed as 0 for a group of data. Why?

Traffic data collected based on the sampling technology has tolerance and can be used only for top N traffic trend analysis.

If there are a large number of sessions on the network, only data of top N sessions can be viewed. The interface collects statistics only on top N data records at a certain time point. As a result, the collected traffic is 0 when real-time traffic exists.

NOTE:

By default, top 100 records are collected. For sessions, top 30 records are collected. A maximum of top 100 records can be collected.

## Why Are Applications Named tcp-app and udp-app Displayed on the Application Traffic Page

### Question

Why are applications named tcp-app and udp-app displayed on the Application Traffic page?

Some network applications are not included in the predefined application scope. If these applications are required, define them by yourself according to the following steps:

1. Select the application you desire, such as tcp-app, on the Application Traffic page.
2. Choose Operation > View Port, select target information based on the protocol, port, and IP address, and click in the Operation column of the target information to create an application.

## Why Is No Interface Available When I Want to Select an Interface for an NTA Report, Traffic Forensics Task, Or Interface Group

### Question

Why is no interface available when I want to select an interface for an NTA report, traffic forensics task, or interface group?

The device to which the selected interface belongs is removed from eSight after a task is created.

## How Can I Modify a Flexible Flow Statistics Template

### Question

How do I modify a flexible flow statistics template?

The Huawei device is used as an example.

1. Run the undo ip netsteam inbound command to disable the interface in the interface view and then run the undo port ip netstream record command to unbind the template from the interface.
2. Modify the template record, bind the template to the interface, and enable the interface.

## Why Is the Traffic Statistics on eSight Double That of the Actual Traffic Statistics

### Question

Why is the traffic statistics on eSight double that of the actual traffic statistics?

Devices of different vendors use different traffic statistics collection modes. Huawei devices collect traffic in both the interface inbound and outbound directions. If traffic statistics collection is enabled in both directions for a Huawei device, the traffic statistics on eSight is double that of the actual traffic statistics. Therefore, you need to enable traffic statistics collection in only one direction (ip netstream inbound or ip netstream outbound) for a Huawei device. Cisco devices collect traffic in the inbound direction only, and you can enable traffic statistics collection in both directions for Cisco devices.

Translation