Network Management

last person joined: 5 hours ago 

Keep an informative eye on your network with HPE Aruba Networking network management solutions
Back to discussions
Expand all | Collapse all

Airwave Traffic report - https AND svc-https?

This thread has been viewed 1 times

  • 1.  Airwave Traffic report - https AND svc-https?

    MVP
    Posted Jan 03, 2020 06:48 AM

    When taking Traffic reports from Airwave we always get both svc-https and https in our report.

     

    Anyone that can explain the difference between the two or rather, how to get them showing up as one if they are the same?



  • 2.  RE: Airwave Traffic report - https AND svc-https?

    EMPLOYEE
    Posted Jan 03, 2020 11:42 AM

    I believe mostly svc-https is Guest traffic, cross check once and also share the screen shot if possible.



  • 3.  RE: Airwave Traffic report - https AND svc-https?

    MVP
    Posted Jan 07, 2020 06:38 AM
      |   view attached

    I am not sure I get your "it is guest traffic" comment.

    Here's the requested screenshot.

    2xhttps.png

     

     

    As you can see Airwave seems to diferently classify svc-https as apposed to https, which is what I do not understand.

    I figured it was something coming over from the controllers user-role or access-list but we even see this when we filter on a specific user-role which is an allowall (no https service explicitly defined).



  • 4.  RE: Airwave Traffic report - https AND svc-https?

    EMPLOYEE
    Posted Jan 07, 2020 09:25 AM

    svc-https is  tcp/ 443 network service on controller, could you run below command on controller to see if controller itself categorizing this or Airwave.

     

    #show datapath session dpi | include svc-https

     

     



  • 5.  RE: Airwave Traffic report - https AND svc-https?

    MVP
    Posted Jan 07, 2020 10:15 AM

    no output on controller. 

    AppID is 0 for all traffic.



  • 6.  RE: Airwave Traffic report - https AND svc-https?

    EMPLOYEE
    Posted Jan 07, 2020 12:03 PM

    Are you seeing application informaiton on controller?We need to install PEF license to view application information.

     

    command show list of licenses installed

    #show license



  • 7.  RE: Airwave Traffic report - https AND svc-https?

    MVP
    Posted Jan 07, 2020 05:26 PM

    PEF is installed and apprf has data.

    Looking at the GUI the controllers traffic analysis has both svc-https and https.



  • 8.  RE: Airwave Traffic report - https AND svc-https?

    MVP
    Posted Jan 08, 2020 04:45 AM

    Another thing I noticed is that Traffic Analysis on the controller shows more than a dozen Google Drive destinations with no way for me to distinguish one from the other.

     

    I have hence opened a support ticket and will get back with the results from that.