Profile Modification

Individual profiles can be created, updated, and deleted on the Edit Profiles page. There is an overview table that lists all the profiles and their channels. A new profile can be added using the New profile button. This button opens a dialog box where you can enter new profile preferences. Fill out the form and click Save.

You can modify profiles by clicking Edit. You can only change the parent profile of a new profile. In a continuous profile, you can add and delete particular channels. If you add a new channel to an existing profile, the data from the past is not processed for this channel. All the performed changes become evident immediately after clicking Save. You can delete a profile by clicking Delete in the overview table.

Creating Profiles

To create a new profile, click New profile.

You can join particular profiles to groups. This can provide a better arrangement in the profiles menu. Choose either an existing group or create a new one. Insertion of a profile to a group affects only its position in the table, nothing else (the rest of its features remain untouched).

Fields Start date and End determine the range of data in the profile. Each profile is derived from its parent profile, and therefore the start and end dates must fit the range of the parent profile.

• If you enter the Start date field and select the Continuous profile checkbox, the continuous profile is created. Data from the past is automatically processed from the Start date to the present according to the profile rules. Then data is stored in the profile's database providing it is not a shadow profile.

• If you enter both a Start date and End date, a history profile is created automatically.

• The Parent profile field can be set only during the creation of the new profile. Its value determines a set of parent channels in channel definition form.

The Maximal size defines the maximal size of profile data. If the profile data reaches this limit, the oldest data is overwritten by the new data. The same applies to the Expires limit defining the maximum data age.

The Granularity option is used for selecting the Profile granularity.

The channel table follows below. It contains a list of all profile channels and their state. In the Name column, there is the name of the channel together with its color. The color circle can be full (all data entities are enabled), half-full (some data entities are disabled), or empty (the channel is disabled). The Channel Options column shows which data entities are disabled. The Position column shows whether the channel chart will be drawn above or below the x-axis. In the Action column, there are icons for editing and deleting a channel.

Creating Channels

You can add an arbitrary number of channels to a profile. Each channel corresponds to one color in the chart. A new channel can be added by clicking New channel.

The Color and Position parameters configure the appearance of data in the chart. Processed data is defined using the Filter and Parent channels fields. The Filter field uses the same syntax and rules as the filter form on the page Analysis (it will be discussed later). In the Parent channels field, there is source data for the configured channel. You can select either the All channels or Selected channels option. The All channels option will always assign all parent channels, even those created later. The Selected channels option allows you to define the exact set of parent channels. The Channel charts options section can be expanded to control which data entities will be processed in the channel. The channel can be Disabled completely by the select box at the top of the form. Disabled channels are not processed at all - no data is captured and no charts are drawn.

The order of channels in the list can be changed by dragging and dropping. The creation of a new profile is finished by clicking Save. Then, the calculation of profile data starts. The length of the calculation process depends on the selected time range. Until the generation is not complete, the charts do not display any data for this profile.

Converting Profiles

The profile may be converted into another type as desired. However, not all conversions are possible. The picture below shows and explains the possible conversions.

By switching profile type between continuous and history you may temporarily stop collecting data for a profile or continue to collect data from a stopped profile. Note that you will lose all flow data when a profile is converted to a shadow profile. When switching back, the data recording resumes at the time of switching.

Predefined Profiles

In the Flowmon Monitoring Center, there are several predefined profiles, that provide information about the history of common protocols and services detected on the monitored link. For example, there are user protocols (HTTP, HTTPS, FTP, SSH), service protocols (SNMP, DNS, DHCP, SAMBA), and many others. The protocol detection is based on port numbers of captured flows, defined by the IANA organization (http://www.iana.org/assignments/port-numbers). Most predefined services are defined over both the TCP and UDP protocols. However, some protocols typically use only one of them (for example, HTTP / TCP port 80). This is frequently exploited by more experienced users, who can use the port 80/UDP to illegally tunnel their traffic (an incorrectly configured firewall might accept the traffic on the port 80/UDP). For this reason, it is very useful for each administrator to see such traffic and that is why all predefined protocols are defined for both the TCP and UDP protocols.