Brocade Network Advisor IP User Manual 1051
53-1003056-01
IP Traffic analyzer monitoring and sFlow reports 33
Enabling and viewing TCP reports
You can monitor TCP traffic to determine if there is any unusual activity on the network, such as
TCP attacks. Identifying unusual activity will aid in understanding the nature of the traffic and the
ports that are affected, so that you can take corrective actions. For example, you may decide to
disable a port on which TCP attacks are being received.
This feature is disabled by default; however, enabling the feature increases the number of distinct
flows that the Management application server must process and, therefore, increases the load on
the server. Complete the following steps to enable TCP reports.
1. Select Server > Options.
The Options dialog box displays.
2. Select IP Preferences from the Software Configurations list in the Category pane.
3. Go to the SFlowDataCollector preferences section.
4. Select the ProcessTCPFlagsData check box to monitor TCP traffic.
5. Click Apply or OK to save your work.
Once TCP reports are enabled, the following reports can be displayed to determine any usual TCP
traffic:
Valid TCP Fl ags: TCP traffic containing packets that do not have any invalid bit combinations.
Invalid TCP Flags: TCP traffic containing packets that have invalid bit combinations as defined
in the configuration.properties file.

Defining invalid TCP packet combinations

TCP packets can be checked to see if they contain the following control bits:
ACK: Acknowledgement field significant bit
URG: Urgent pointer field significant bit
PSH: Push function bit
RST: Reset connection bit
SYN: Synchronize sequence number bit
FIN: No more data from sender
An occurrence of two of these bits together in a TCP packet could be regarded as invalid. You
specify in the configuration.properties file which combinations are invalid combinations. By default,
the following combinations are regarded as invalid:
RST-SYN
RST-FIN
RST-PSH
RST-URG
FIN-SYN
Complete the following steps to change these combinations.
1. Select Server > Options.
The Options dialog box displays.