IntellaView GUI

Access Control Lists (ACLs) filter network traffic by controlling whether packets are forwarded or blocked based on Layer 1 through Layer 3 criteria specified within the ACL.

ACLs can be saved and stacked together, facilitating the formation of complex filters ensuring only the traffic that a tool needs is sent to that tool.

Identify overall port health, port configurations, and port tags for maximum control over traffic flow.

View statistics from all or specific ports on all or specific blades installed in the switch on one screen. With the addition of an optical bypass tap connections can be:

• One-to-One
• One-to-Many
• Many-to-Many
• Many-to-One One-to-load balance group (LBG)
• Many-to-load balance group (LBG)

Using Standby Ports, IntellaView can configure active and standby ingress ports in a connection as either a failover pair or a failover cluster of ports. Standby ports ensure traffic continues being forwarded if a traffic disruption occurs on an active port.

IntellaView’s Data Visualization feature provides access to multiple graphical representations of live or stored data so you can examine your system from different perspectives in real time or historically.

Select data based on Connections, Ports, or Service Engines, and choose the type of graphical presentation (Line, Column, Pie, Radar, or Sanky) that allows the data to be visualized in the most useful format.

The IntellaView GUI includes Toast Notifications—messages that do not require a user response. They pop up on the screen and then are automatically dismissed without user interaction after a few seconds. Toast Notifications are reserved for the initial notification of an alarm.

Toast Notifications can be customized so each user can turn them on or off, select the area of the screen in which they display, how long the notifications are shown (between 2-30 seconds), and the minimum severity of alarms (critical, major, or minor) they want to see.

Application Filtering & Intelligence identifies and categorizes Layer 7 applications and protocols even when encrypted or obfuscated, facilitating more efficient tool usage. Control traffic volume by filtering out low-risk content like streaming apps or applications with known security flaws or vulnerabilities. DPI-based packet classification on the IntellaView HyperEngine provides real-time Application Filtering on each service engine (license required).

Perform application classification and response time calculations with Application Intelligence (license required) for ACI-4033-E00 HyperEngine blades. This module exports data as IPFIX records, which have application information for the sessions. The metadata provided in the IPFIX records include:

• Application ID of a specific application such as Google Cloud, Microsoft Outlook, Netflix, or Zoom)
• Application Group ID such as Cloud and CDN Services, Conference, Mail, or Streaming
• Session data like start/end times, packet and byte counts per direction, and other data

The HyperEngine can use regular expressions to match packet contents and filter traffic, allowing you to search on individual packets, sessions, or across fragmented packets.

Actions include:

• None – useful for getting stats or insights into the traffic
• Mask - swap out the text that matches the regex with a user-specified character
• Pass - pass packets that match the regex
• Drop - drop packets that match the regex
• Session pass - pass all packets in the flow when a packet matches the regex
• Session drop - drop all packets in the flow when a packet matches the regex

Tools typically have minimal buffer space so traffic is dropped quickly if a tool is sent more traffic than it can handle. An overburdened tool may also become overwhelmed and not perform its function properly. Use a HyperEngine blade to limit transmitted traffic to a user- specified average rate by buffering incoming packets and sending them out at a steady, even flow. Each HyperEngine service engine can buffer from 3 to 160 million packets, depending on packet size, shared across all connections to ensure your existing tools are never oversubscribed even as bandwidth expands.

Packet-Aware Slicing makes it possible to slice all frame types at specified slice points for up to 10 different frame types using four user-specified IP protocols. The default setting can be calibrated to slice packets or to pass them through unsliced.

If users want to allow a certain number of packets in a session to pass through unsliced before slicing all remaining session packets, APCON offers Session-Aware Slicing. A session is defined as a time-delimited, two-way link that enables the exchange of information between two or more entities. With this capability, network teams can see the initial, unencrypted packets that establish a TLS/SSL session, and then slice the remaining packets.