[AF] AF Mirror mode deployment shows Traffic Ranking ranking

Problem Description

AF Mirror mirroring mode deployment shows abnormal Traffic Ranking ranking:
The Traffic Ranking displayed is different when different audit Objects are selected. When server is selected (only a few server IPs), more than 60+Kb of traffic is displayed, but when the intranet Network Segment is selected (including the IP in the server Objects), there is no traffic. The Objects includes IPs as shown in the figure below:

When selecting a server Objects:

When selecting an intranet Network Segment:

Root cause

If you select a single server IP, the traffic of all other IPs interacting with this server IP will be counted; if you select a server range, the traffic of IPs interacting within the server range will not be counted and displayed, and the data of other IPs interacting with the IPs within the range will be counted. Therefore, when the scope of traffic Statistics Objects is different, the Statistics results will also be different.

solution

Traffic Ranking Statistics mechanism: Once a Network Objects is selected for Statistics, the IPs within the range of the Network Objects are considered to be intranet users. The Traffic Ranking will Statistics the traffic between other IPs and the selected Network Objects, but the traffic Network Objects will not be Statistics.

Original Link

https://support.sangfor.com.cn/cases/list?product_id=13&type=1&category_id=1023&isOpen=true