Profile Types

A profile has a type of History or Continuous. A history profile starts and ends back in the past and remains static. It neither grows nor expires. A continuous profile may start in the past and is continually updated while new flow data becomes available. It grows dynamically and may have its own expiration values set. Old data expires after a given amount of time or when a certain profile size is reached. Additionally, a profile can be created as a Shadow profile, which means no flow data is collected - this saves disk space. A shadow profile accesses the data of its parent profile when data processing is done with the proper profile filters applied first. The All Sources profile is a special type of profile. This profile is on the top of the profiles hierarchy. It contains all flow data collected and cannot be deleted. All profiles in the FMC are generated from data collected from the All Sources profile (they are subprofiles of All Sources). For this reason, every profile except All Sources has its parent profile defined. A profile is built from the data of its parent profile.

Summary

1. Continuous

   • Contains flow data

   • Has dedicated expiration values

2. History

   • Contains flow data

   • Starts and ends at a defined time

3. Continuous / Shadow

   • Contains no flow data

   • Inherits expiration values from the parent profile

4. History / Shadow

   • Contains no flow data

   • Starts and ends at a defined time

Profile Types by Granularity

A profile can be of one of the following types, which might differ in granularity, graph data collection, graph data history length, and so on.

5-minute profiles

• 5-minute granularity of flow data and graph - 6-month history

• 1-day granularity of flow data and graph - 5-year history

• Graph data is available for All, TCP, UDP, ICMP, and other traffic

• Graph data is available for flows, packets, and traffic

• Can be built from history data

• Its subprofile can be of any type

1-minute profiles

• 1-minute granularity of flow data and graph - 1-month history

• 1-day granularity of flow data and graph - 1-year history

• Graph data is available for All traffic

• Graph data is available for flows, packets, and traffic

• Cannot be built from history data

• Its subprofile can be 1-min and 30-sec profile

30-second profiles

• 1-minute granularity of flow data and graph - 1-month history

• 1-day granularity of flow data and graph - 1-year history

• Graph data history length is one year

• Graph data is available for All traffic

• Graph data is available for flows, packets, and traffic

• Cannot be built from history data

• Its subprofile can be 1-min and 30-sec profile

Profile Channels

A profile contains one or more profile channels. A profile channel is defined by its channel filter, color, sign, and the order in which the channel is displayed in the graph. A channel is based on one or more parent channels. Each channel can contain the following data entities:

• Captured flows

• Charts of bytes

• Packets

• Flows (Traffic charts)

• Graphs of NPM metrics (NPM charts)

By default, all entities are enabled for a new channel and can be disabled in channel options to save CPU performance or storage.

Profile examples: user or service protocols (http, ftp, smtp, dns, and so on), web server communication, upload/download on the company backbone, and so on.