Response time analysis: Difference between revisions

no edit summary
No edit summary
No edit summary
Line 178: Line 178:


* The first column allows to add new elements or remove existing one:
* The first column allows to add new elements or remove existing one:
- adds a new request or response
:- adds a new request or response
{|           
{|           
| [[File:Plus.png|60px|right]]
| [[File:Plus.png|60px|right]]
Line 184: Line 184:




- removes the request or response entry from the list
:- removes the request or response entry from the list
{|           
{|           
|[[File:Minus.png|60px|right]]
|[[File:Minus.png|60px|right]]
|}
|}






* The second columns allows to choose the name of the request or response.
* The second columns allows to choose the name of the request or response.
 
:The name is purely informational and can be chose freely.
The name is purely informational and can be chose freely.


* The third column contains all defined patterns for each request or response.
* The third column contains all defined patterns for each request or response.


 
:- This button removes the single pattern directly right of the button. All other patterns are untouched.
 
- This button removes the single pattern directly right of the button. All other patterns are untouched.
{|           
{|           
| [[File:Minus.png|60px|right]]
| [[File:Minus.png|60px|right]]
|}
|}


- This button adds a new pattern to the list of patterns for the corresponding request or response. Multiple patterns are possible to use and combined by '''OR''' or '''AND''' operation.  
:- This button adds a new pattern to the list of patterns for the corresponding request or response. Multiple patterns are possible to use and combined by '''OR''' or '''AND''' operation.  
This allows to search for multiple patterns within a single packet which must occur both or any. For example, this can be used to distinguish between multiple protocol variants.
This allows to search for multiple patterns within a single packet which must occur both or any. For example, this can be used to distinguish between multiple protocol variants.
{|           
{|           
|[[File:Plus.png|60px|right]]
|[[File:Plus.png|60px|right]]
|}
|}




Line 230: Line 225:
* 0-10: the data must be found within the first 10 bytes of data (that is byte 0 to byte 9).
* 0-10: the data must be found within the first 10 bytes of data (that is byte 0 to byte 9).


– Join command: Except for the first pattern, the other patterns might be connected with the previous one by choosing the appropriate join command.  
:– Join command: Except for the first pattern, the other patterns might be connected with the previous one by choosing the appropriate join command.  
The list is evaluated left to right without any priority so '''AND''' and '''OR''' can be mixed carefully to build complex expressions.
The list is evaluated left to right without any priority so '''AND''' and '''OR''' can be mixed carefully to build complex expressions.
The pattern may either match together with the previous one ('''AND''' operation), or that the previous or the current pattern must match ('''OR''' operation).
The pattern may either match together with the previous one ('''AND''' operation), or that the previous or the current pattern must match ('''OR''' operation).
Line 237: Line 232:
'''Pattern examples:'''
'''Pattern examples:'''


– data: HELLO
:– data: HELLO
   
   
data type: string
data type: string
Line 245: Line 240:
'''Meaning: The pattern only applies if the text “HELLO” is found exactly at the start of the payload data.'''
'''Meaning: The pattern only applies if the text “HELLO” is found exactly at the start of the payload data.'''


– data: 8779827668
:– data: 8779827668


data type: hexadecimal
data type: hexadecimal
Line 262: Line 257:
This example describes how to measure the response time of HTTP GET requests.
This example describes how to measure the response time of HTTP GET requests.


1. Add a new protocol definition by clicking at the ‘plus’ button.
#Add a new protocol definition by clicking at the ‘plus’ button.
 
#Enter a name for this protocol definition. “HTTP GET” is short and appropriate.
2. Enter a name for this protocol definition. “HTTP GET” is short and appropriate.
#As layer 7 protocol filter select “HTTP”. If you only want to analyze one specific HTTP server, define a new protocol for only this IP in the L7 module and select it from the custom protocol list.
 
#Now edit the requests by clicking at the ‘pencil’ button.
3. As layer 7 protocol filter select “HTTP”. If you only want to analyze one specific HTTP server, define a new protocol for only this IP in the L7 module and select it from the custom protocol list.
#Add a new request by clicking at the ‘plus’ button.
 
#Enter the name of this request, “GET” is a good choice.
4. Now edit the requests by clicking at the ‘pencil’ button.
#Add a new pattern by clicking at the ‘plus’ button in the third column.
 
#Enter the three characters “GET” (without the quotes) into the data field
5. Add a new request by clicking at the ‘plus’ button.
#Make sure the “data type” drop down box still shows the default value “String”.
 
#Enter “0” (without the quotes) as the position, as the HTTP GET request always starts with the GET string.
6. Enter the name of this request, “GET” is a good choice.
#The settings should look like the following picture:
 
7. Add a new pattern by clicking at the ‘plus’ button in the third column.
 
8. Enter the three characters “GET” (without the quotes) into the data field
 
9. Make sure the “data type” drop down box still shows the default value “String”.
 
10. Enter “0” (without the quotes) as the position, as the HTTP GET request always starts with the GET string.
 
11. The settings should look like the following picture:


{| class="wikitable sortable"
{| class="wikitable sortable"
Line 290: Line 275:




12. Click at ‘DONE’ to return to the previous mask for the HTTP protocol definition.
#Click at ‘DONE’ to return to the previous mask for the HTTP protocol definition.
 
#Now edit the responses by clicking at the ‘pencil’ button.
13. Now edit the responses by clicking at the ‘pencil’ button.
#Add a new response by clicking at the ‘plus’ button.
 
#Enter the name of this response, “HTTP response” is a good choice.
14. Add a new response by clicking at the ‘plus’ button.
#Add a new pattern by clicking at the ‘plus’ button in the third column.
 
#Enter the characters “HTTP/1” (without the quotes) into the data field.
15. Enter the name of this response, “HTTP response” is a good choice.
#Make sure the “data type” drop down box still shows the default value “String”.
 
#Enter “0” (without the quotes) as the position, as the HTTP response always starts with the HTTP/1 string.
16. Add a new pattern by clicking at the ‘plus’ button in the third column.
#The settings should look like the following picture:
 
17. Enter the characters “HTTP/1” (without the quotes) into the data field.
 
18. Make sure the “data type” drop down box still shows the default value “String”.
 
19. Enter “0” (without the quotes) as the position, as the HTTP response always starts with the HTTP/1 string.
 
20. The settings should look like the following picture:
{| class="wikitable sortable"
{| class="wikitable sortable"
|-
|-
Line 313: Line 290:




21. Click at ‘DONE’ to return to the previous mask for the HTTP protocol definition.
#Click at ‘DONE’ to return to the previous mask for the HTTP protocol definition.
 
#The settings should look like the following picture:
22. The settings should look like the following picture:
{| class="wikitable sortable"
{| class="wikitable sortable"
|-
|-
Line 322: Line 298:




23. Click again at ‘DONE’ to finalize the configuration of HTTP protocol definition.
#Click again at ‘DONE’ to finalize the configuration of HTTP protocol definition.
 
#The settings should look like the following picture:
24. The settings should look like the following picture:
{| class="wikitable sortable"
{| class="wikitable sortable"
|-
|-
Line 330: Line 305:
|}
|}


25. Save the settings so the new definition takes effect.
#Save the settings so the new definition takes effect.
1,775

edits