User's Guide

ExtremeAnalytics Historical Flow Table
108 of 218
NOTES:
l Matches are stored and displayed per engine. If you have multiple
engines, use the
Engine menu to select an engine to use as the
source for the Hits and Matches data.
l If a flow generates hits on multiple fingerprints, and one
fingerprint has a higher confidence than another fingerprint, a hit
is counted for each fingerprint, but a match is only recorded for
the final, highest confidence fingerprint.
l If you need to reset the Matches counters, use the Reset
Fingerprint Counters option from the Menu icon ( ).
Type
The fingerprint type refers to how the fingerprint determines a match.
l FlexFire — These fingerprints execute specific matching algorithms encoded into
the engine. Disabling the fingerprint disables the specific code that implements the
fingerprint.
l PCRE — These fingerprints search using Perl Compatible Regular Expressions
(PCRE).
l Port-based — These fingerprints search for traffic on a specific port (typically,
server-only ports). These are very low-confidence fingerprints and are generally just
used for wider coverage.
l Web-App Rule — These fingerprints search for a specific hostname in the URI of
web requests.
l SSL Name — These fingerprints search for values in the SSL common name.
l Http Host — These fingerprints search for values in the HTTP hostname.
l Decoder — These fingerprints extract protocol metadata from a flow that is provided
when we generate a match on that flow.
l General — Any fingerprint that isn't included in one of the other types. Typically,
these fingerprints search for a straight pattern, or for a specific port and/or IP
address with custom fingerprints (excluding custom Web-App Rule fingerprints).
Enabled
A indicates the fingerprint is enabled. When a fingerprint is enabled, it will
be used to identify applications. When it is disabled, it will be ignored.
Last Modified
Date that the fingerprint was last modified.