Hosts

From Edge Threat Management Wiki - Arista
Revision as of 22:58, 25 February 2016 by Dmorris (talk | contribs) (→‎Current Hosts)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigationJump to search

Host Viewer

The Host Viewer is viewable by selecting "Show Hosts" at the dropdown at the top of the rack. The Host Viewer shows the information stored in the host table which is a global table that tracks local hosts and the various information about them.

Current Hosts

The Current Hosts tab shows all the currently known (local) hosts and all the information about them.

Many applications store information about the various hosts on the network. For example, If a user logs into Captive Portal, the Captive Portal will store the associated username in the host table so other applications know this information about this hosts. Each row show a given host and all the information currently stored for that host (IP).

The viewable information about a host is listed below

Column Header Property Description
IP The IP address of the host (the primary key)
MAC Address MAC address the network interface (wireless, ethernet) used by the host.
MAC Vendor Vendor of the network interface (wireless, ethernet) used by the host.
Last Accessed Time Last time information about this host was updated
Last Session Time Last time a non-bypassed session was initiated by this host
Hostname The hostname of this IP (if known)
Username The username of this IP (if known)
Penalty Boxed Is this host in the Penalty Box (true is yes)
Penalty Box Entry Time Time the host entered the penalty box
Penalty Box Exit Time Time the host will exit the penalty box
Quota Size The Quota size in bytes granted to this host (if it has a quota)
Quota Issue Time The time the quota was issued
Quota Expiration Time The time the quota will expire
HTTP - User Agent The host's browser reported User Agent string
Captive Portal - Authenticated Stores the authentication state of this host through Captive Portal (true/false)
Captive Portal - Username The username of this host according to Captive Portal
Directory Connector - Username The username of this host according to Directory Connector
L2TP - Username The username of this host according to L2TP in IPsec VPN
Xauth - Username The username of this host according to Xauth in IPsec VPN
Device Username The username of this host according to the Device Username in the Device List

Clicking on the dropdown on the column header provides several features to help view large data sets:

  • Sort values by that row.
  • Hide/Unhide certain columns
  • Group by that column (all shared values will be grouped together)
  • Filter data (only show data that matches the provided filter on that row)

Penalty Box Hosts

This tab shows all the host currently in the Penalty Box. This is just a different view of the same information shown in the Current Hosts tab. It only shows hosts where Penalty Boxed is true.

Penalty Box Event Log

This event log shows penalty box enter and exit events.

The columns of the event log:

Name Description
Start Time The time the host was put in the penalty box.
End Time The time the host is planned to be or was released from the penalty box.
Address The host/IP placed in the penalty box
Reason The text string explaining the reason the host was placed in the penalty box.

Current Quotas

This tab shows all the hosts currently with a quota. This is just a different view of the same information shown in the Current Hosts tab, except only showing hosts with a quota.

Quota Event Log

This event log shows all quota events.

The columns of the event log:

Name Description
Timestamp The time of the event
Address The host/IP placed in the penalty box
Action The action of the event.
Quota Size The size of the quota.
Reason The text string explaining the reason the action was taken.