Configuring Export of UDP Flow Analysis Results

Context

Intelligent traffic analysis for UDP flows does not require packets to traverse the same path in both directions. The UDP flow table created by the TAP based on a UDP block contains only unidirectional information about a UDP flow. Therefore, all intelligent traffic analysis results of UDP flows must be exported to the TDA to analyze and obtain characteristics of bidirectional packets in UDP flows.

UDP flow analysis results can be exported only after you specify the source IP address and at least one destination IP address and one destination UDP port number for the exported packets.

Procedure

Enter the system view.
system-view
Configure the source IP address for the exported packets that carry UDP flow analysis results.
traffic-analysis udp export source { ip ip-address | ipv6 ipv6-address }

By default, no source IP address is configured for the exported packets that carry UDP flow analysis results.
If no source IP address is configured, packets are not exported. Packets can be exported based on IPv4 or IPv6 source addresses, but IPv4 and IPv6 addresses cannot be both configured using one command. Ensure that there are reachable routes between the source IP address and destination IP address (TDA's IP address) of the packets. If you need to configure a new export IP address, perform either of the following operations based on the actual scenario:
- If the IP address types before and after the change are the same, such as when IPv4 address A is changed to IPv4 address B or IPv6 address A is changed to IPv6 address B, run the traffic-analysis udp export source { ip ip-address | ipv6 ipv6-address } command to replace an existing IP address.
- If the IP address type before the modification is different from that after the modification, such as when IPv4 address A is changed to IPv6 address B or IPv6 address B is changed to IPv4 address A, run the undo traffic-analysis udp export source [ ipv6 ] command to delete the original source address and then run the traffic-analysis udp export source { ip ip-address | ipv6 ipv6-address } command to configure a new source address.
Configure the destination IP address and destination port number for the exported packets that carry UDP flow analysis results.
traffic-analysis udp export host { ip ip-address | ipv6 ipv6-address } port-number [ vpn-instance vpn-instance-name ]

By default, no destination IP address or destination port number is configured for the exported packets that carry UDP flow analysis results.
Either an IPv4 or IPv6 address can be configured in the system view, but the IPv4 and IPv6 addresses cannot be both configured using one command. In addition, only one destination TDA address can be set on a device. If you need to configure a new export IP address, perform the either of the following operations based on the actual scenario:
- If the IP address types before and after the modification are the same, such as when IPv4 address A is changed to IPv4 address B or IPv6 address A is changed to IPv6 address B, run the traffic-analysis udp export host { ip ip-address | ipv6 ipv6-address } port-number [ vpn-instance vpn-instance-name ] command to replace an existing IP address.
- If the IP address type before the modification is different from that after the modification, such as when IPv4 address A is changed to IPv6 address B or IPv6 address B is changed to IPv4 address A, run the undo traffic-analysis udp export host [ ipv6 ] command to cancel the original destination TDA address, and then run the traffic-analysis udp export host { ip ip-address | ipv6 ipv6-address } port-number [ vpn-instance vpn-instance-name ] command to configure a new destination TDA address.
(Optional) Configure the interval at which the template for exporting packets carrying UDP flow analysis results is delivered.
traffic-analysis udp export template timeout-rate timeout-interval

By default, the template is delivered at an interval of 1 minute.