The DoS profiles show a comparative display of short-term and long-term distribution for the selected profile.
To view the DoS profiles -
For individual Sensors, navigate to Devices → <Admin Domain Name> → Devices → <Device Name> → Troubleshooting → Denial of Service → Profiles.
For Sensors in HA pair, navigate to Devices → <Admin Domain Name> → Devices → <Device Name> → Member Sensors → <HA Pair Node> → Troubleshooting → Denial of Service → Profiles.
(Applicable to NS9600 and NS9500 only) For Sensors in a stack and a HA pair of stack Sensors, navigate to Devices → <Admin Domain Name> → Devices → <Device Name> → Member Sensors → <Stackname-node id> → Troubleshooting → Denial of Service → Profiles.
The Dos Profiles page is displayed. It details the current status of DoS learning mode policies applied to an interface or sub-interface. DoS policy was inherited from the domain upon Sensor addition but might have changed due to the application of a different policy at the interface or sub-interface level.
DoS Profiles page for a individual Sensor.png "GUID-2000EDC7-91FA-4D5B-91B7-40B1024AE1DA-low.png")
DoS Profiles page for member Sensor in a stack.jpg "11_1M9-StackMember-dosprofiles.jpg")
Option definitionsOption
Definition
Profile
The sub-interface or VLAN/CIDR ID where a DoS profile was applied. Default NI refers to all traffic that is not a part of an interface subdivision, that is, sub-interface, VLAN tag, or CIDR block.
Status
Lists whether the profile is currently learning or detecting. Learning means the profile baseline is being built. Detection means the learning profile has finished and traffic is being checked against the baseline.
Transition Time
The exact time when the learning profile started analysis or when the active detection for the learning profile began. The Status field indicates which process is currently operating.
Select a DoS profile and click View.
DoS profile - Advanced Scanning.png "GUID-08B6BD39-EE7F-4663-9430-50AD3E09D074-low.png")
Optionally, select the direction (Example: Inbound) and a measure (example: tcp-control) to display rate data for the measures in the DoS profile applied to the selected interface.
When reading the chart, it is helpful to remember that:
The long-term profile is the compilation of the short-term profiles.
The horizontal axis contains buckets of the various packet rates.
The vertical axis indicates the percentage of those rates falling into each bucket.
Click Close to go back to the DoS Profiles page.