There is a defect DE339798 which affected the accuracy of the IN/OUT views.
Patch NFA_9.3.3_PTF_012 was released to address this, but can only be applied to NFA 9.3.3 consoles that have no other patches at this time.
This fix will also be in NFA 9.5. If you are on another version and need this patch please contact CA Support.
With the patch applied the AS Summary reports have IN and OUT views as well as TO and FROM views.In total we have four charts in the AS number view – IN/OUT/FROM/TO.
To help you understand this better, please look at the below example:
- IN Chart: This chart shows the Top Source AS number on that interface with interface in INGRESS mode.
- OUT chart: This chart shows the Top Destination AS number on that interface with interface in EGRESS mode.
- FROM chart: This chart doesn’t consider the INGRESS/EGRESS mode of interfaces, it just shows Top Source AS numbers on this interface.
- TO chart: This chart doesn’t consider the INGRESS/EGRESS mode of interfaces, it just shows Top Destination AS numbers on this interface.
The above table is created based on the actual data from one of the pcap from customer.This table represent two Flow records with 2 interfaces and total of 3 AS numbers. The below are the values each chart would represent if the above flow is received for interface 10.
|Flow||Input interface||Output Interface||Src AS||Dst AS||Bytes/octets|
|IN||4812||The Top Src AS for interface 10 in INGRESS mode. Since we have only one flow in INGRESS, 4812 is the Top Src AS.|
|OUT||71||The Top Dst AS for interface 10 in EGRESS mode. Since we have only one flow in EGRESS, 71 is the Top Dst AS.|
|We have two Src AS numbers 4812 and 0, since for flow with 0 as Src AS has 200 bytes data, 0 becomes Top 1 and 4812 becomes 2nd from Top.|
|We have two Dst AS numbers 0 and 71, since for flow with 71 as Dst AS has 200 bytes data, 71 becomes Top 1 and 0 becomes 2nd from Top.|