Network Traffic Analyzer 7.2 (E0401P04) Copyright 2016 Hewlett Packard Enterprise Development LP Table of Contents 1. What's New in this Release 2. Problems Fixed in this Release 3. Software Distribution Contents 4. Installation Prerequisites 5. Installing and Upgrading 6. Removing 7. Port Usage 8. Known Problems What's New in this Release 7.2 (E0401P04) can be upgraded from only 7.2 (E0401), 7.2 (E0401P01) and 7.2 (E0401P03). The following list all features released after 7.0 (E0101). Features released in 7.2 (E0401P04) 1. Support for analyzing VXLAN traffic. Features released in 7.2 (E0401P03) 1. The Top 10 Traffic Report for Session Host bar chart was added to the session statistics page of host traffic analysis task query. Features released in 7.2 (E0401P01) Features released in 7.2 (E0401) 1. Traffic distribution can be displayed for links on the custom topology map. 2. Lower-Level Traffic Analysis Server. 3. Application and host traffic analysis tasks support threshold settings and can generate threshold alarms. 4. Displaying traffic distribution for host traffic analysis tasks on interface links in the topology. 5. Displaying traffic distribution on links of aggregate interfaces in the topology.
6. NetStream-based VXLAN traffic analysis. 7. Support device IP changed. 8. provides end-to-end path analysis for the top N sources/destinations/sessions on a host. 9. supports manual input of baseline thresholds in percentages and recovery of baseline threshold alarms. 10. Supports the QSP extension of the platform. 11. Supports collecting application traffic statistics based on the DPI. Features released in 7.1 (E0301P09) 1. provides end-to-end path analysis for the top N sources/destinations/sessions on a host. 2. supports manual input of baseline thresholds in percentages and recovery of baseline threshold alarms. Features released in 7.1 (E0301P08) Features released in 7.1 (E0301P07) 1. Displaying traffic distribution for host traffic analysis tasks on interface links in the topology. 2. Displaying traffic distribution on links of aggregate interfaces in the topology. 3. NetStream-based VXLAN traffic analysis. Features released in 7.1 (E0301H06) Features released in 7.1 (E0301P05) 1. Application and host traffic analysis tasks support threshold settings and can generate threshold alarms. Features released in 7.1 (E0301P04) Features released in 7.1 (E0301P03) 1. Traffic distribution can be displayed for links on the custom topology map. 2. Lower-Level Traffic Analysis Server. Features released in 7.1 (E0301H02)
Features released in 7.1 (E0301H01) Features released in 7.1 (E0301) 1. Supported the Web desktop. 2. Supported Cisco ASA 5510 firewalls. 3. Supported sflow packets with Layer 3 headers following the MPLS labels. 4. inter-business traffic analysis tasks support selecting interfaces or probes for collecting statistics. 5. Probes support RHEL 6.4 (64-bit). Features released in 7.0 (E0201P02) 1. Max. Link Utilization added for interface traffic analysis tasks. 2. Opens the report data sources o The data sources of traffic baseline data. Features released in 7.0 (E0201H01) Features released in 7.0 (E0201) 1. Added the Interface flux report for an Interface Traffic Analysis Task. 2. Added the Single Interface Traffic Summary Report. 3. Added the feature of querying domain names through IP addresses. Features released in 7.0 (E0101P01) 1. The Statistics Direction option was added for configuring an inter-business traffic analysis task. 2. The business based on continuous address segments can be added for configuring an inter-business traffic analysis task. Features released in 7.0 (E0101) 1. The perspective graph feature is added to the source, destination, and session pages. 2. Automatically discovers the interfaces sending traffic. 3. The sequence arrangement feature is added to the task list on the task summary page. 4. Opens the report data sources o o The data sources of VPN traffic analysis tasks. The data sources of the 10-minute peak values and valley values of traffic analysis tasks.
Problems Fixed in this Release 7.2 (E0401P04) fixes the following problems, including all bugs fixed after 7.0 (E0101). Problems fixed in 7.2 (E0401P04) 1. The receiver process exits with an exception when receives a NetFlow v9 packet containing the NBAR ID information from a Cisco device. 2. cannot process the IPFIX-compliant NetStream v10 template correctly. As a result, it cannot correctly parse the MPLS traffic received in NetFlow v10 packets. 3. In distributed deployment, the database tables failed to be upgraded during the upgrade of the component. 4. The webpage failed to be refreshed automatically at the refresh interval. Problems fixed in 7.2 (E0401P03) 1. A page error occurs when the Next button is clicked on the Select Task Type page for adding a traffic analysis task. Problems fixed in 7.2 (E0401P01) 1. An error page appears after Export is clicked on the Traffic tab for a VPN traffic analysis task. 2. Apache Commons Collections Java library has security holes when deserializing data. Problems fixed in 7.2 (E0401) 1. On the inter-business traffic analysis task traffic details page, the displayed information might be inaccurate and disordered. 2. On the host session summary page, if you select a secondary server, information about the primary server is displayed. 3. When you click the bar graph on the traffic analysis overview page, the page might be navigated to other traffic analysis tasks. To solve this problem, click the link for a task on the traffic analysis overview page. 4. If you do not input the query time for a traffic analysis task, an error page appears when you switch between tabs. 5. Interfaces of different devices cannot be added to an interface traffic analysis task when they use the same interface description and the same interface index. 6. A filter strategy includes a filter condition based on source and destination hosts, but cannot filter packets by both source and destination hosts. 7. interface threshold alarms display incomplete description information. 8. The check box for selecting all tasks is ineffective on the host task setting page.
9. The system fails to load the single business report for an inter-business traffic analysis task when you switch back to this report from a single business details report. 10. The navigation bar disappears if you choose to display the Top 10 traffic report for unknown applications by source or destination port. 11. An error page appears after one or more tasks are selected for the Application Traffic for Host Task (Last 1 Hour) widget on the imc home page. 12. After is upgraded to E0301, all legacy scheduled reports become unavailable and HTTP 404 errors occur. 13. Although a host traffic analysis task has excluded an IP address range, excluded IP addresses might still appear as the source or destination hosts in traffic analysis. 14. The task has no data when the task contains an interface with multiple IP addresses assigned. Problems fixed in 7.1 (E0301P09) 1. The task has no data when the task contains an interface with multiple IP addresses assigned. Problems fixed in 7.1 (E0301P08) 1. When runs on Linux and uses the Oracle database, VLAN/VXLAN traffic analysis tasks do not have data. 2. When interfaces at both ends of a link are added to the same host traffic analysis task, the topology does not display traffic distribution for the task on the link. 3. Incorrect threshold alarms or threshold recover alarms are generated for a traffic analysis task, which do not match the threshold alarm settings of the task. To resolve the issue, set the active time to 1 minute on the device. 4. After the device IP address is modified in the imc platform, the following scheduled reports are not generated: device interfaces traffic summary report and single interface traffic summary report. Problems fixed in 7.1 (E0301P07) Problems fixed in 7.1 (E0301H06) 1. The Direction In/Out threshold alarm setting is configured for a host traffic analysis task. When a traffic direction threshold alarm is generated, a traffic recovery alarm for the opposite direction is generated and automatically recovers the traffic direction threshold alarm. 2. An operator logs out and then back in to, and opens a traffic task page from the host traffic analysis task summary list. However, the traffic task page does not display the Threshold link.
3. Redundant threshold recover alarms are generated for a host traffic analysis task or application traffic analysis task. 4. After an unconfigured interface is added to an interface traffic analysis task, the interface monitor data is incorrect and the interface still appears in the unconfigured interface list. Problems fixed in 7.1 (E0301P05) 1. When an operator clicks a pie chart of the last 24-hour traffic on the platform custom topology, the time range for querying the last 24-hour application traffic is the last 1 hour rather than 24 hours. 2. When click the other traffic on the distribution pie chart on the Source or Destination tab of an task of any type, the links to a page with no data. Problems fixed in 7.1 (E0301P04) 1. An error page appears after one or more tasks are selected for the Application Traffic for Host Task (Last 1 Hour) widget on the imc home page. 2. Two operators concurrently edit the same custom topology in two browsers and both add links for interfaces that are monitored by an interface traffic task. After one operator finishes editing the links, the other operator clicks the pie chart and encounters an error page. 3. After is upgraded to E0301, all legacy scheduled reports become unavailable and HTTP 404 errors occur. 4. Although a host traffic analysis task has excluded an IP address range, excluded IP addresses might still appear as the source or destination hosts in traffic analysis. Problems fixed in 7.1 (E0301P03) 1. The check box for selecting all tasks is ineffective on the host task setting page. 2. The system fails to load the single business report for an inter-business traffic analysis task when you switch back to this report from a single business details report. 3. The navigation bar disappears if you choose to display the Top 10 traffic report for unknown applications by source or destination port. 4. On the database space usage page, an operator selects Custom from the Time list, leaves the Start Time or End Time field empty, and clicks Query. Then a query error occurs. Problems fixed in 7.1 (E0301H02) 1. Interfaces of different devices cannot be added to an interface traffic analysis task when they use the same interface description and the same interface index. 2. A filter strategy includes a filter condition based on source and destination hosts, but cannot filter packets by both source and destination hosts.
3. interface threshold alarms display incomplete description information. Problems fixed in 7.1 (E0301H01) 1. When automatically discovers a large number of interfaces, the receiver messages are frequently updated. However, when you view the interface traffic analysis tasks, these tasks do not have traffic data. 2. If you do not input the query time for a traffic analysis task, an error page appears when you switch between tabs. Problems fixed in 7.1 (E0301) 1. This version does not support collaboration with Platform HTML 5 topology. 2. cannot obtain the IP address of an interface automatically discovered based on traffic, and the IP address of the interface sending traffic is recognized as the device IP address. 3. On the inter-business traffic analysis task traffic details page, the displayed information might be inaccurate and disordered. 4. On the host session summary page, if you select a secondary server, information about the primary server is displayed. Problems fixed in 7.0 (E0201P02) 1. A probe cannot be started if it is installed on an RHEL 5.X operating system. 2. When monitors interfaces of a large number of devices, data might be unable to be collected after the configuration is deployed. 3. No pivot chart can be added on the Source, Destination, and Session tabs of Traffic Analysis Task. 4. In distributed deployment where is deployed on multiple subordinate servers, the Sessions floating menu displays blank. 5. Baseline analysis and threshold alarming information is displayed incorrectly. Problems fixed in 7.0 (E0201H01) 1. The number of devices added cannot reach the number specified by the license. Problems fixed in 7.0 (E0201) Problems fixed in 7.0 (E0101P01) 1. The probe is installed in the Linux RedHat 6.1 operating system, and the probe process is started. After the device mirrors traffic to the probe, the probe server restarts. 2. On the traffic analysis task summary page, you can select tasks that you do not have privilege to.
3. When the device sends NetStream V9 logs, cannot automatically discover the interfaces sending traffic. 4. When is deployed in distributed mode, the interfaces sending traffic which are automatically discovered on the primary server are incorrect. 5. On the host session number summary page, you cannot select a single host to view its trend graph. 6. On the traffic analysis task management page, the total number of tasks displayed is incorrect. 7. When the data size is large, the task of automatically deleting the expired logs fails, and the SQLSERVER log quickly grows to a maximum value. 8. The listening port deployed to sflow devices is always 9021. 9. On the session tab of an interface traffic analysis task page, click the pie chart. The system prompts a server error. 10. When you add a VLAN, probe, or host traffic analysis task, the devices or probes on secondary servers cannot be selected. 11. When you set the probe traffic analysis task parameters on the home page, the system prompts a server error. 12. If is upgraded to V7 when a device not configured in sends traffic to the server, traffic analysis tasks might fail to display data. Problems fixed in 7.0 (E0101) 1. Deploy in distributed mode with a separate database. The master server uses the database on the subordinate server, and the subordinate server uses the database on the master In this case, the database on the master server will be mistaken as the shared database. 2. When is deployed in distributed mode or deployed with a separate database, if you view the device interface traffic summary report or device application summary report in the reporting module, prompts that errors occur to searching the JNDI names. Software Distribution Contents The 7.2 (E0401P04) distribution list contains the following files and folders: 1. \manual\readme_nta_7.2 (E0401P04).html - this file 2. \windows\install - the installation program for Windows OS 3. \linux\install - the installation program for Linux OS 4. \probe - the probe installation program for Linux OS
Installation Prerequisites Server Requirements The following are the minimum hardware requirements and supported software programs to run : Platform Compatibility o Platform version: PLAT 7.2 (E0403) and its patches Hardware o 3.0Ghz dual core CPU 2 or more o 6GB RAM or higher o 720GB of free hard disk space or higher Operating system o Windows Server 2008 with Service Pack 2 o Windows Server 2008 X64 with Service Pack 2 o Windows Server 2008 R2 with Service Pack 1 o Windows Server 2012 with KB2836988 o Windows Server 2012 R2 o Red Hat Enterprise Linux 5 (Enterprise and Standard versions only) o Red Hat Enterprise Linux 5 X64 (Enterprise and Standard versions only) o Red Hat Enterprise Linux 5.5 (Enterprise and Standard versions only) o Red Hat Enterprise Linux 5.5 X64 (Enterprise and Standard versions only) o Red Hat Enterprise Linux 5.9 (Enterprise and Standard versions only) o Red Hat Enterprise Linux 5.9 X64 (Enterprise and Standard versions only) o Red Hat Enterprise Linux 6.1 X64 (Enterprise and Standard versions only) o Red Hat Enterprise Linux 6.4 X64 (Enterprise and Standard versions only) VMware: o VMware Workstation 6.5.x o VMware Workstation 9.0.x o VMware ESX Server 4.x
o VMware ESX Server 5.x Hyper-V: o Windows Server 2008 R2 Hyper-V o Windows Server 2012 Hyper-V Database o Microsoft SQL Server 2008 Service Pack 3 (Windows only) o Microsoft SQL Server 2008 R2 Service Pack 2 (Windows only) o Microsoft SQL Server 2012 Service Pack 2 (Windows only) o Microsoft SQL Server 2014 (Windows only) o Oracle 11g Enterprise versions Release 1 (Linux only) o Oracle 11g Enterprise versions Release 2 (Linux only) o MySQL Enterprise Server 5.1 (Linux and Windows) (Up to 1000 devices are supported) o MySQL Enterprise Server 5.5 (Linux and Windows) (Up to 1000 devices are supported) o MySQL Enterprise Server 5.6 (Linux and Windows) (Up to 1000 devices are supported) Installing and Upgrading To install : 1. Before installing, make sure that the platform is installed correctly and the platform version is PLAT 7.2 (E0403) or later. 2. To install, click Install button on the Monitor tab of the Intelligent Deployment Monitoring Agent, then select the components sub-directory of the upgrade package, and click OK button to launch the installation wizard. To upgrade : 1. Back up the database on the Environment tab in Deployment Monitoring Agent. 2. Stop the system in the Deployment Monitoring Agent. 3. Click Install on the Monitor tab of the Deployment Monitoring Agent. 4. Select the install/components subdirectory of the upgrade package, and click OK.
5. After the installation is complete, the Intelligent Deployment Monitoring Agent lists the components that need to be upgraded. Click OK to start upgrading the components. 6. If this is a distributed deployment, upgrade the components deployed on the slave servers separately. 7. After the upgrade is complete, start all processes in the Intelligent Deployment Monitoring Agent window. For more information about installation and upgrade procedures, see Getting Started Guide and deployment guides. Removing You can remove the component through the intelligent deployment monitoring agent. To do this, follow these steps: 1. In the Intelligent Deployment Monitoring Agent window, click Stop on the Monitor tab to stop all processes of. 2. On the Deploy tab, right-click the component, and select Uninstall the Component from the shortcut menu. 3. When an un-installation success dialog box appears, click OK. Port Usage uses the following TCP/IP ports. Component Subcomponent Protocol Port Configurable Use Server Client Notes - TCP 8051 No - TCP 9099 No Used by the unbaserver process to receive the SHUTDOWN command. JMX monitoring port used by the unbaserver process. master master Internal use. Internal use.
Component Subcomponent Protocol Port Configurable Use Server Client Notes - UDP 18801 No - UDP 18802 No - UDP 18803 No - UDP 9020 No - UDP 9021 No - UDP 6343 No Used by the jserver process and receiver process to communicate. Used by the jserver process and processor process to communicate. Used by the jserver process and unbaserver process to communicate. Used to receive network packet. Used to receive network packet. Used to receive network packet. master master master Network devices. - Network devices. - Network devices. - Internal use. Internal use. Internal use. Known Problems For a correct installation, the installation path can contain letters, digits, underlines, and spaces, but cannot other special characters. When you trigger the configuration deployment through adding or modifying a traffic analysis task or configuring parameters, the configurations on the receiver might fail to be updated. When you use browsers not recommended by, script errors might occur on the pages. Please use the recommended browsers. The VPN traffic analysis task cannot export the traffic report.
When you click the bar graph on the traffic analysis overview page, the page might be navigated to other traffic analysis tasks. To solve this problem, click the link for a task on the traffic analysis overview page. Database connection error occurs when you analyze an interface traffic application task report by application or protocol. The Sub Traffic Analysis Server window has no data when the current imc system accesses lower-level imc through HTTPS. On the imc home page, a host task is selected for the Traffic Trend for Host Task (Last 1 Hour) widget, but the widget does not have data. If a device includes an apostrophe (') in the name or description, the interface traffic analysis task that contains interfaces of the device does not have data. An imc viewer cannot display the host session monitoring information on the traffic analysis page. Issued: Aug. 2016 Copyright 2016 Hewlett Packard Enterprise Development LP