Filtering and Aggregating Traffic

This Public Stable API method allows you to handle broadcast and multicast traffic better, save storage in the traffic database, and reduce the stress of the whole data pipeline.

Windows-heavy environments can have a large amount of broadcast or multicast traffic, which can be as much as 50% in syslog data and 30% in traffic data. Because some broadcast and multicast data might not be useful for writing policies, this API provides a function to filter out or aggregate the broadcast and multicast traffic that is not useful.

Note

This API is implemented in Supercluster.

Note

Only administrators and users with appropriate privileges can make filtering changes.

Traffic Collector API Methods

Use these methods to get, create, update, or delete a traffic collector.

Functionality	HTTP	URI
Get a traffic collector collection	`GET`	`[api_version][org_href]/settings/traffic_collector`
Get a specific collector instance	`GET`	`[api_version][org_href]/settings/traffic_collector/:uuid`
Create a traffic collector	`POST`	`[api_version][org_href]/settings/traffic_collector`
Update a specific traffic collector instance	`PUT`	`[api_version][org_href]/settings/traffic_collector/:uuid`
Delete a specific traffic collector instance	`DELETE`	`[api_version][org_href]/settings/traffic_collector/:uuid`

Query Parameters

Use the following parameters.

Parameters	Description	Type
`org_id`	Org ID	Integer
`traffic_collector_setting_id`	traffic_collector setting UUID	String

Response Properties

Properties	Description	Type
`href`	URI of the destination	String
`transmission`	Transmission type: broadcast/multicast/unicast	String
`action`	Drop or aggregate the target traffic: If you select "drop," the PCE drops all the traffic that matches the filters you supply. The data will be lost forever. If you select "aggregate," the PCE performs aggregation on broadcast traffic and multicast traffic . If one broadcast or multicast traffic flow is received by multiple workloads, all reported flows on the same traffic are aggregated into one record in the traffic database, and the destination workload information will be lost. PUT method will fail if you change the aggregator from “broadcast” to “multicast” because the default port and protocol will not pass the validation step.	String
`data_source`	Flow summary data source	String
`target`	The target object has the following properties: `dst_port`: Single destination ip address or CIDR . Can be an Integer or NULL `proto`: Port is required for POST `dst_ip`: Single destination ip address or CIDR `src_port`: Single source ip address or CIDR. Allows users to filter traffic based on the source port. `src_ip`: Single source ip address or CIDR If `dst_port` and `dst_ip` are not specified for the target session, traffic is dropped on "all ips" and "all ports" by default. PUT method will fail If the traffic filter you want to modify has “ANY” in port or protocol field, and you want to modify other fields in this filter. The change will fail because the default port and protocol will not pass the validation step. Oracle flows are currently filtered via a runtime `src_ip/dst_ip` (CIDR) setting and this feature is not available in SaaS. Runtime changes also require a PCE restart, while API settings do not. The collector filters now support `src_ip` (CIDR) so that various filters can be created per organization without restarting the PCE.	Object Integer Integer String String

Examples for Traffic Collector

CURL Command for settings_traffic_collector_post

curl -i -u api_10415cd5bcc0e14cc:'2ac31cbee8cd3e8fa7ca79d32d39a0249636624ada675965dd2ec239e3ea8af0' --request POST --data '{"action":"drop","transmission":"unicast","target":{"proto":6,"src_ip":"10.1.2.3"}}' https://2x2testvc360.ilabs.io:8443/api/v2/orgs/2/settings/traffic_collector --header "Content-Type: application/json"

Broadcast Transmission and Drop Action

curl 'https://pce.my-company.com:8443/api/v2/orgs/1/settings/traffic_collector' -H 'Origin: https://pce.my-company.com:8443' -H 'Accept-Encoding: gzip,deflate, br' -H 'content-type: application/json' -H 'accept: application/json' -H 'Referer: https://pce.my-company.com:8443/' -i -u api_1dfe2432a7b314ee6:'21c10ea1a4ad38d76ef22977e8ac45bc10839c5cc6ebffd650eae4f95dc5b364'--data-binary '{"transmission": "broadcast","action": "drop","target":{"proto": 17,"dst_port": 20, "dst_ip":"10.255.255.255"}}' --compressed

Multicast Transmission and Aggregate Action

curl 'https://pce.my-company.com:8443/api/v2/orgs/1/settings/traffic_collector' -H 'Origin: https://pce.my-company.com:8443' -H 'Accept-Encoding: gzip, deflate, br' -H 'content-type: application/json' -H 'accept: application/json' -H 'Referer: https://pce.my-company.com:8443/' -i -u api_1dfe2432a7b314ee6:'21c10ea1a4ad38d76ef22977e8ac45bc10839c5cc6ebffd650eae4f95dc5b364'--data-binary '{"transmission": "multicast","action": "aggregate"} ' --compressed

Example Response

{
	"$schema": "http://json-schema.org/draft-04/schema#",
	"type": "object",
	"required": ["href", "transmission", "action"],
	"properties":{
		"href": {
			"description": "URI of the destination",
			"type": "string"
		},
		"transmission":{
			"description":"transmission type: broadcast/multicast",
			"type":"string",
			"enum":[
			"broadcast",
			"multicast"
			]
		},
		"target":{
			"type":"object",
			"required":[
			"proto"
			],
			"properties":{
			"dst_port":{
			"type":"integer"
			},
			"proto":{
			"type":"integer"
			},
			"dst_ip":{
			"type":"string",
			"description": "single ip address or CIDR"
			}
			}
		},
		"action":{
			"description":"drop or aggregate the target traffic",
			"type":"string",
			"enum":[
			"drop",
			"aggregate"
			]
			}
		}
	}

REST APIs for 22.5