Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What kind of statistics can I collect with Advanced Traffic Inspection?
Short answer
The Advanced Traffic Inspection action groups traffic by the Smart Variables selected in the Fields to Track field (e.g. client IP, User-Agent, Host header or a combination of them) and keeps counters for each value over the Tracking Period window. On an HTTP vService, request count, erroneous requests, incoming and outgoing data, total and current connections are collected; on an L7 TCP vService, incoming and outgoing data, total and current connections are collected. The counters are monitored as a live table in the Logs & Tracking tab of the vService and are bound as a threshold to actions such as Block with the Tracking Condition condition. The action on its own does not change traffic and does not produce notifications.
How Does It Work?
- The action is added to the action list of the vService; the optional Conditions field narrows which traffic is counted.
- For each request or connection, the combination of the Fields to Track values forms a key (e.g. client IP + User-Agent).
- The counters of the key are calculated over the Tracking period window; a key whose traffic stops stays in the table for the duration of the period and then drops out.
- When the table reaches the Max. Table Size limit, the oldest records are deleted.
Collected Counters
| Counter (name in the table) | HTTP | L7 TCP |
|---|---|---|
| HTTP Requests: number of requests in the Tracking period | ✓ | - |
| HTTP Errors: number of erroneous requests in the Tracking period | ✓ | - |
| Incoming Data (B): incoming data in the period | ✓ | ✓ |
| Outgoing Data (B): outgoing data in the period | ✓ | ✓ |
| Total Connections: connections established in the period | ✓ | ✓ |
| Current Connections: connections open at that moment (not tied to the period) | ✓ | ✓ |
Fields
| Field | Meaning |
|---|---|
| Fields to Track | The key of the counter; at least one Smart Variable is selected (client IP, header, cookie, etc.) |
| Traffic Tag | The tag of the table; it must be unique among all actions. The Tracking condition refers to the table with this tag |
| Tracking Period | The window in which the counters are calculated (seconds, minutes, hours or days); default 1 second |
| Max. Table Size | The maximum number of keys kept in the table; between 5 and 1,000,000, default 10000 |
At most 15 Advanced Traffic Inspection tables run on a vService; any more are not created.
Where Is It Used in TR7?
- Monitoring: In the Logs & Tracking tab of the vService screen, the
<action-name> (TRACKING, <period>)entry is selected from the source list; the counters of each key are seen row by row, records can be removed from the table with Remove from Table and are exported with Export (Advanced Traffic Inspection (Tracking) Logs). - Threshold and action: The Tracking Condition condition compares these counters with a threshold; by binding the condition to an action such as Block, a per-client request limit is set up: Can I do rate limiting (X requests per second per IP)?, Can I apply rate limiting based on a key such as an API key / token?
- Notification: The action does not send notifications; for source-based alerts: Can I define advanced notifications based on source IP, country, ASN or subnet (Advanced Notifications)?
Common Misconceptions
- "Advanced traffic inspection limits traffic." The action only counts; limiting is done with an action bound with the Tracking condition.
- "The counters appear as graphs on the Dashboard." The counters are monitored in the live table in the Logs & Tracking tab; the table does not keep a history record.
- "The request count is kept in L7 TCP." On an L7 TCP vService, there are no HTTP Requests and HTTP Errors counters; connection and data counters are kept.
- "Total Connections is a cumulative total." The value is the number of connections in the Tracking period window.
How it is done in the documentation
