Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Superflows

JSA analyzes individual flows to look for indicators that common attack vectors are being used on your network. When the number of flows that match the criteria reaches a specified number, JSA groups the individual flows into a superflow.

You can configure the flow threshold to control the number of unique flows that must match the criteria before a superflow is created. Given a threshold of 100, the first 99 flows are sent as normal flow records. The 100th flow and subsequent matching flows are included in the superflow record. JSA continues to report on the superflow every minute, until one full interval passes with no matching traffic. Because a superflow is kept alive even if only one flow record matches, some superflows might appear to be small.

Tip:

If you do not want JSA to create superflows, in the Flow Processor configuration settings, change the Create Super Flows setting to No.

Superflow Type A: Network Scan

A network scan attempts to discover all of the active hosts on your network and map the hosts to an IP address.

JSA looks for flows where one host sends data to many hosts, and flags this type of activity as a Type A superflow. This unidirectional flow is an aggregate of all of the flows that have the same source IP with different destination IPs, but the following parameters are the same:

  • Protocol

  • Source bytes-to-packets ratio

  • Source IP address

  • Destination port (TCP and UDP flows only)

  • TCP flags (TCP flows only)

  • ICMP type and code (ICMP flows only)

Superflow Type A: Network Scan

Superflow Type B: Distributed Denial of Service (DDoS)

A DDoS attack occurs when multiple systems flood the bandwidth or resources of a targeted system.

JSA looks for flows where many hosts send data to one destination host, and flags this activity as a Type B superflow. This unidirectional flow is an aggregate of all of the flows that have different source IPs with a single destination IP, but the following parameters are the same:

  • Protocol

  • Source bytes-to-packets ratio

  • Destination IP address

  • Destination port (TCP and UDP flows only)

  • TCP flags (TCP flows only)

  • ICMP type and code (ICMP flows only)

Superflow Type B: Distributed Denial of Service (DDoS)

Superflow Type C: Port Scan

A port scan attempts to identify the ports that are in use by a specific host on your network.

JSA looks for flows that have one source IP and one destination IP, but many ports. This unidirectional flow is an aggregate of all non-ICMP flows that have different source or destination ports, but the following parameters are the same:

  • Protocol

  • Source IP address

  • Destination IP address

  • Source bytes-to-packets ratio

  • TCP flags (TCP flows only)

Superflow Type C: Port Scan