Cisco Cisco Web Security Appliance S690 User Guide

V I E W I N G   L 4   T R A F F I C   M O N I T O R   A C T I V I T Y

C H A P T E R   1 7 :   L 4   T R A F F I C   M O N I T O R

 393

V I E W I N G   L 4   TR A F F I C   M O N I T O R   A C T I V I T Y

The S-Series appliance supports several options for generating feature specific reports and 
interactive displays of summary statistics. 

You can use options on the Monitor > Reports pages of the web interface to select a type of 
report, capture data, schedule periodic email delivery, and archive reports.

For more information about working with reports, see “Reporting Overview” on page 414.

The Monitor > L4 Traffic Monitor page provides statistical summaries of monitoring activity. 
You can interactively update these displays by specifying a time range of hour, day, week or 
month. Additionally, you have the option to print these display pages and export the raw data 
to a file.

You can use the following displays and reporting tools to view the results of L4 Traffic Monitor 
activity:

Note — If the Web Proxy is configured as a forward proxy and L4 Traffic Monitor is set to 
monitor all ports, the IP address of the proxy’s data port is recorded and displayed as a client 
IP address in the client activity report on the Monitor > Client Activity page. If the Web Proxy 
is configured as a transparent proxy, enable IP spoofing to correctly record and display the 
client IP addresses.

The L4 Traffic Monitor log file provides a detailed record of monitoring activity. For more 
information about the L4 Traffic Monitor log, see “Traffic Monitor Log” on page 462.

Table 17-2 L4 Traffic Monitor Scanning Data

To view...

See...

Client statistics

Monitor > Client Activity

Malware statistics
Port statistics

Monitor > L4 Traffic Monitor

L4 Traffic Monitor log files

System Administration > Log Subscriptions
• trafmon_errlogs
• trafmonlogs