This article addresses the following:
Getting a reliable feed of mirror traffic is not as simple as it might seem. Use the following guidelines for verifying your traffic feed.
Because JATP web collectors are often deployed in a highly dynamic network environment, it's important to do periodically monitoring and review the web collector itself, as well as the traffic feed (span/tap/mirror port) servicing it. JATP can only detect malware effectively if the web collectors and traffic feeding them are in good health.
What does Juniper Networks do with GSS Telemetry?
Juniper uses detailed telemetry sent to our Global Security Service (GSS) available to assist in troubleshooting - avoiding the need for a remote session.
Setting Up Collector Health Alerts:
Collector Health Alerts will be generated whenever traffic is detected to fall below a certain value at a certain time. For more details, please see the JATP CLI Command Reference Guide For Example:
JATP (server) # set system-alert traffic 100 time 30
will trigger an alert of the bandwidth drops below 100 Kbps over when measured across a 30-min timespan.
You must also have a System Alert set up
There are two places to review the Collector status in the JATP Web UI. First under Dashboard > Collectors:
Notice on this collector the bandwidth is quite low. Expanding the triangle icon on the left gives more details:
Clicking the checkbox will plot the traffic over the selected time period. [Note: the checkmark won't appear until the traffic is plotted, which can take a few seconds]
Review Web Collector settings in GUI
Under Config > System Profiles > Web Collectors you will find additional configuration-related setting (such as proxies)
Run Setupcheck in the CLI
Also found in the CLI, but under "diagnosis" mode is our setupcheck facility:
JATP (diagnosis) # setupcheck all
This runs a comprehensive check of the major system components AND the traffic feed, and should be the first thing you check when you see or suspect a problem.
Periodic end-to-end testing
Finally, while the system provides good basic checks, there is no substitute for running real tests with real data. You need a web server supporting HTTP (or HTTPs if you have a middlebox). It may not always be practical due to topology (i.e. a remote office) but asking a colleague in those locations to download a file by providing the URL will probably work. Immediately after the file download is complete, check the Web UI Dashboard with the "Benign" filter applies - you should see all the files from the test. If not, there may be an issue.
2019-06-28: Minor edits. Non-technical.