User's Guide

Creating Fingerprints Based on a Destination Address
119 of 218
Create Custom Fingerprints Based on
Destination Address
The ExtremeAnalytics feature uses fingerprints to identify to which application a
network traffic flow belongs. A fingerprint is a description of a pattern of
network traffic which can be used to identify an application. Extreme
Management Center provides thousands of system fingerprints with the
ExtremeAnalytics feature. In addition, you can create new custom fingerprints.
Creating Fingerprints Based on a Destination
Address
Often, you will create a new custom fingerprint to cover a case where no
appropriate fingerprint existed. However, you may also want to create a new
fingerprint for traffic flows already identified as one application, but should be
categorized as something else.
For example, let's say you have a Git repository on your network. Git repositories
(a source code management system used in software development) are
frequently accessed via SSH on port 22 (the standard TCP port assigned for SSH
traffic). In this case, the SSH traffic flows is identified using the system SSH port-
based fingerprint.
But what if you would like to more closely monitor who is accessing the Git
repository? If you know you are running the Git server on a certain system
(10.20.117.102 port 22, for our example), you can create a custom fingerprint to
identify the Git traffic flows.
The fingerprint is based on one of the SSH flows using the IP address/port of the
Git server and have a higher confidence than the system port-based fingerprint.
The higher confidence fingerprint will override the lower confidence fingerprint
when determining a match for the traffic flow.
Use the following steps to create the fingerprint.
1. Select the Analytics tab in Extreme Management Center.
2. Select the Application Flows tab.