Reviewing RiskVision packet statistics

Diagnostics | TRITON RiskVision | 02-June-2016

Use the Diagnostics > Packets tab to find packet statistics for traffic seen by the Capture service. This includes both dropped, ignored, and whitelisted packets.

The IP Packets tables at the top of the page show:

The number of IPv4 and IPv6 packets processed, not processed, dropped (both total and as a percentage of all packets seen), and monitored.

An breakdown of Monitored packets that shows both what was discarded (for being non-IP traffic, whitelisted on the Rules page, or ignored) and what was accepted for further processing.

All statistics in the Monitored table are provided both as a number of packets and as a percentage of all packets seen.

Ignored packets include any packet that is not part of an existing session, or the start of a new session. They also include invalid packets, duplicate packets, and packets that are part of an already closed session.

Information about monitored Packet Anomalies, including IP fragments, duplicates, retransmits, and out-of-order packets.

The TCP Ports table provides a breakdown of the monitored traffic by port. It includes information about traffic direction, the number of TCP segments, and the volume of traffic on each port as a percentage of all monitored traffic.