Profile Types

A profile has a type of History or Continuous. A history profile starts and ends back in the past and remains static. It neither grows nor expires. A continuous profile may start in the past and is continually updated while new flow data becomes available. It grows dynamically and may have its own expiration values set. Old data expires after a given amount of time or when a certain profile size is reached. Additionally, a profile can be created as a Shadow profile, which means no flow data is collected - this saves disk space. A shadow profile accesses the data of its parent profile when data processing is done with the proper profile filters applied first. The All Sources profile is a special type of profile. This profile is on the top of the profiles hierarchy. It contains all flow data collected and cannot be deleted. All profiles in the FMC are generated from data collected from the All Sources profile (they are subprofiles of All Sources). For this reason, every profile except All Sources has its parent profile defined. A profile is built from the data of its parent profile.

Summary

1. Continuous

   • Contains flow data

   • Has dedicated expiration values

2. History

   • Contains flow data

   • Starts and ends at a defined time

3. Continuous / Shadow

   • Contains no flow data

   • Inherits expiration values from the parent profile

4. History / Shadow

   • Contains no flow data

   • Starts and ends at a defined time

Profile Granularity

• 30-second granularity of graph - 3-month history

• 5-minute granularity of graph - 5-year history

• Graph data is available for All, TCP, UDP, ICMP, and other traffic

• Graph data is available for flows, packets, and traffic

• Graph data is available for NPM metrics (NPM charts)

• 5-minute granularity of flow data - history depends on allocated space

Profile Channels

A profile contains one or more profile channels. A profile channel is defined by its channel filter, color, sign, and the order in which the channel is displayed in the graph. A channel is based on one or more parent channels. Each channel can contain the following data entities:

• Captured flows

• Charts of bytes

• Packets

• Flows (Traffic charts)

• Graphs of NPM metrics (NPM charts)

All entities are enabled for a channel. A whole channel can be disabled in channel options to save CPU performance or storage.

Profile examples: user or service protocols (http, ftp, smtp, dns, and so on), web server communication, upload/download on the company backbone, and so on.