User's Guide

Adding a Fingerprint
157 of 218
l Address <IPaddress> with mask on port <port number> — Creates a
fingerprint that identifies traffic either coming from or going to the specified
subnet on the specified port. For example, an IP address of 192.168.0.0 with a
mask of 16 would result in all traffic either coming from or going to the 192.168
subnet on the specified port to be identified by the fingerprint.
l Host <host name> — Creates a fingerprint that identifies a specific hostname in
the URI of web traffic.
l HTTP Header — Creates a fingerprint that identifies traffic containing specified
HTTP header information, if HTTP header information is included in the flow's
metadata.
Note that there may be two port number or IPaddress options listed: one
for the flow's source port/IP address and one for the flow's destination
port/IPaddress.
5. If you selected an IP address with mask option, you need to specify a subnet of IP
addresses. Enter the IPCIDRmask, which is a mask on the flow IP, with 0-32 for IPv4
and 0-128 for IPv6.
6. Enter the name of the application for which the fingerprint is defined.
7. Use the drop-down list to select the application group to which the application
belongs. If none of the existing groups are appropriate, you can enter a new group
name and the new group is automatically created.
8. Select the fingerprint's confidence level. The confidence level defines the reliability
of this fingerprint. Higher confidence fingerprints override lower confidence
fingerprints, if multiple fingerprints match a flow. Values are 1-100, with 100 being
absolutely reliable.
9. Enter a description of the fingerprint, if desired.
10. Click Save. The new fingerprint is created on the Extreme Management Center
server.
11. Enforce to push the new fingerprint to your engines.
TIP: You can also create a custom fingerprint from the Fingerprints tab. Click the Menu icon and
select Create Fingerprint. The Add Fingerprint window opens where you can select all the flow
components you want for the fingerprint. The new fingerprint is not based on an existing
fingerprint and you need to enter values for all required fields such as IP or Hostname,
Application Name, and Application Group. The new fingerprint must be enforced to engines
before it can take effect.