Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Flow Source Aliases Management

 

A flow source alias uses a virtual name to identify external flows that are sent to the same port on a flow processor. For example, the JSA Flow Processor can have a single NetFlow flow source that is listening on port 2055, and can have multiple NetFlow sources sending to the same JSA Flow Processor. By using flow source aliases, you can identify the different NetFlow sources based by their IP addresses.

When JSA Flow Processor receives traffic from a device that has an IP address but does not have a current alias, the JSA Flow Processor attempts a reverse DNS lookup. The lookup is used to determine the host name of the device.

You can configure the JSA Flow Processor to automatically create flow source aliases. When the JSA Flow Processor receives traffic from a device that has an IP address but does not have a current alias, it does a reverse DNS lookup to determine the host name of the device.

If the lookup is successful, the JSA Flow Processor adds this information to the database and reports the information to all JSA Flow Processor components in your deployment. If the lookup fails, JSA creates a default alias for the flow source based on the flow source name and the source IP address. For example, the default alias might appear as default_NetFlow_172.16.10.139.

Adding or a Flow Source Alias

Use the Flow Source Alias window to add a flow source alias.

  1. On the navigation menu (), click Admin.
  2. In the Data Sources section, under Flows, click Flow Source Aliases.
  3. Do one of the following actions:
    • To add a flow source alias, click Add and enter the values for the parameters.

    • To edit an existing flow source alias, select the flow source alias, click Edit, and update the parameters.

  4. Click Save.
  5. On the Admin tab, click Deploy Changes.Note

    If you rename a flow source alias, you must use the original name to perform a historical search.

Deleting a Flow Source Alias

Use the Flow Source Alias window to delete a flow source alias.

  1. On the navigation menu (), click Admin.
  2. In the Data Sources section, under Flows, click Flow Source Aliases.
  3. Select the flow source alias that you want to delete, and then click Delete.
  4. On the Admin tab, click Deploy Changes.