43.1. TRFA resource

43.1. TRFA resource
	Chapter 43. TRFA - Traffic Analyzer

The Abilis CPX TRFA resource provides the following features:

Configures each IP interface for the desired capture detail (TOTALS, by IP, by PROTOCOL, by IP and PROTOCOL). The configuration parameters related to this function are present in the IP resource configuration.
Shows the total traffic for each interface.
Shows the traffic by IP address.
Shows the traffic by protocol/applications (FTP, TELNET, etc.).
Shows the traffic by IP address and a protocol/application.
Shows the desired traffic types of the last day/week/month/year.
Shows the traffic as individual interface or all summed interfaces.
Shows graph or table view.
Results are presented using the Abilis HTTP server (see HTTP resource).

Configuring the TRFA resource and the section inside the IP resources are needed to activate the IP Traffic Analyzer.

43.1.1. Activating the TRFA resource

Add the resource to the Abilis system with the following command:

[11:01:39] ABILIS_CPX:a res:trfa

RES:TRFA ALREADY EXISTS

The TRFA resource may already exist in the system, but may not yet be active: set it active with the command:

[11:01:48] ABILIS_CPX:s act res:trfa

COMMAND EXECUTED

	Caution
	After adding or setting the TRFA active, you must restart the Abilis to make the resource running (use the command warm start to reboot the Abilis).

[11:01:39] ABILIS_CPX:s p trfa act:yes

COMMAND EXECUTED

[11:01:39] ABILIS_CPX:d p trfa

RES:Trfa ----------------------------------------------------------------------
Run    DESCR:Traffic_Analyzer
       LOG:DS               ACT:YES              rt-max-clients:20
       WDIR:C:\APP\TRFA\
       - IP section -----------------------------------------------------------
       ACT-IP:YES           max-addresses:1000   max-png:5      
       - CTI section ----------------------------------------------------------
       ACT-CTI:YES        
         - Cti Router ---------------------------------------------------------
         N1:#                              N1-NAME:
         N2:#                              N2-NAME:
         N3:#                              N3-NAME:
         N4:#                              N4-NAME:
         N5:#                              N5-NAME:
         N6:#                              N6-NAME:
         N7:#                              N7-NAME:
         N8:#                              N8-NAME:
         N9:#                              N9-NAME:
         N10:#                             N10-NAME:

43.1.2. TRFA resource parameters

Use the following command to display the parameters of the resource; the d p trfa ? command shows the meaning of parameters.

[17:06:43] ABILIS_CPX:d p trfa

RES:Trfa ----------------------------------------------------------------------
Run    DESCR:Traffic_Analyzer
       LOG:DS               ACT:YES              rt-max-clients:20
       WDIR:C:\APP\TRFA\
       - IP section -----------------------------------------------------------
       ACT-IP:YES           max-addresses:1000   max-png:5      
       - CTI section ----------------------------------------------------------
       ACT-CTI:YES        
         - Cti Router ---------------------------------------------------------
         N1:#                              N1-NAME:
         N2:#                              N2-NAME:
         N3:#                              N3-NAME:
         N4:#                              N4-NAME:
         N5:#                              N5-NAME:
         N6:#                              N6-NAME:
         N7:#                              N7-NAME:
         N8:#                              N8-NAME:
         N9:#                              N9-NAME:
         N10:#                             N10-NAME:

Meaning of the most important parameters:

LOG: Logging functionalities activation/deactivation.
ACT: Runtime TRFA activation/deactivation.
rt-max-clients: Number of monitors that can require information from TRFA [1..50]. NOTE: an equal of greater number of HTTP sessions must be available.
WDIR: Directory where traffic data files are stored. It cannot be empty. Physical full path in DOS notation, i.e. starting with a drive letter in the range ['A'..'Z'] and ending with the '\' character. Max. 128 characters. Case is preserved. Spaces are allowed. Strings holding spaces must be written between quotation marks (E.g.: "C:\My dir\").
ACT-IP: IP traffic analysis activation [NO, YES].

max-addresses: Maximum number of pair IPP + IP address in the address table [2..8000].
max-png: Maximum number of PNG shell objects that will be used for create PNG files [1..20].
ACT-CTI: CTI traffic analysis activation [NO, YES].
N1..N10: Numbers set. Calls with called number (CD) that matches Nxx are counted in the TRFA statistics of number set with Nxx-NAME. Search for match is performed sequentially from N1 to N10. From 1 up to 20 characters, in the range ['0'..'9', '*'] optionally preceded by TON [u, i, n, o, s, h, c] and/or NP [x, e, d, t, l, p] attributes or "*" or "#" or the name of an IN/RU/MR list between single quotes (e.g. 'listname' or # or ux123* or 555 or *). The '*' is allowed only alone or as the last character. See HELP ISDN ATTRIBUTES for details on attributes.
N1-NAME..N10-NAME: Numbers set name. Up to 16 characters. Spaces are not allowed. Case is preserved. If name is cleared, the numbers set statistics are cleared.

The following command allows the administrator to change the configuration of the resource:

s p trfa parameter:value...

	Caution
	To activate the changes made on the upper case parameters, execute the initialization command init res:trfa; while to set act the changes made on the lowercase parameters a save conf and an Abilis restart are required (i.e. with warm start command).

43.1.3. Activating the TRFA inside IP resources

Activating the traffic survey on an IP resource, type:

[17:45:32] ABILIS_CPX:s p ip-1 trfa:yes

COMMAND EXECUTED

[17:45:41] ABILIS_CPX:d p ip-1

RES:Ip-1 - IP over LAN (LAN) --------------------------------------------------
Run    DESCR:LAN
       OPSTATE:UP             LOG:NO                 STATE-DETECT:NORMAL
       LANRES:Eth-1
       IPADD:192.168.029.254  MASK:255.255.255.000   
       REDIS:EXT     HIDE:NO         RP:NONE            IPSEC:NO       VRRP:NO
       NAT:INSIDE    UPNP:NO         DIFFSERV:NO        DDNS:NO
       OUTBUF:100    OUTQUEUE:FAIR   MTU:1500           BRD:NET
       OUTSPL:NO     
       INBUF:0                       mru:1500           SRCV:NO
       - TRFA section ---------------------------------------------------------
       TRFA:YES     TRFA-MODE:TOTALS       
       - Lan ------------------------------------------------------------------
       LLOG:NO       arpcache:200    CACHETIMER:120     rxbuf:4     txbuf:14
       VLAN-ID:UNTAG 
RES:Eth-1 ---------------------------------------------------------------------
Run    DESCR:
       LOG:DS            MODE:AUTO         DUPLEX:HALF   
       dma-rxbuf:250     dma-txbuf:25      max-vlans:0       
       ip-rxbuf:25       arp-rxbuf:5       pppoed-rxbuf:5    pppoes-rxbuf:25

In the “TRFA Section” the following parameters will appear:

TRFA: Enables/disables traffic analysis.
TRFA-MODE: Select traffic analysis mode [TOTALS: saves the total global traffic; PROT: subdivides the registration for the main protocol models; IP: saves the totals for every single IP address; IP-PROT: subdivides the traffic by protocol, for every single crossing IP address];
IP-RESERVE: Reserves records in the traffic analysis data base: it represents the maximum IP number trace.
TRFA-SIDE: Selects IP address type [LOCAL: filters the traffic by destination IP address; REMOTE: filters the traffic by source IP address].
TRFA-IPADD: IP address filter.


Chapter 43. TRFA - Traffic Analyzer		43.2. TRFA diagnostics, statistics and debug