Advertisement
Zone Traffic Learning
Learning Phase 2 – Threshold Tuning
Note
Cisco Traffic Anomaly Detector User Guide
4-16
Note that the Detector enables the use of an asterisk (*) as a wildcard
denoting either of the following options:
All of the Detector's zones. Issuing no learning* reject means aborting
–
the learning phase for all of the Detector's zones.
A wildcard denoting zone names (i.e. OBL*).
–
2.
Choose ENTER.
During this stage the Detector constructs its detection policies and begins to tune
its traffic type thresholds (see
To begin the second Learning phase perform the following:
From the Global command group level type the following:
1.
admin@DETECTOR# learning threshold-tuning <zone-name>
Or alternatively:
From the zone command group level type the following:
admin@DETECTOR-conf-zone-<zone-name># learning threshold-tuning
Where
zone-name
Note that the Detector enables the use of an asterisk (*) as a wildcard
denoting either of the following options:
–
All of the Detector's zones. Issuing learning threshold-tuning* means
setting the threshold tuning phase for all of the Detector's zones.
–
A wildcard denoting zone names (i.e. OBL*).
Choose ENTER.
2.
Cisco Systems recommends letting the Learning Phase 2 - Threshold Tuning
continue for 24 hours before concluding.
Chapter 7, "Policy Procedures"
specifies a zone name.
Chapter 4
Zone Configuration
for further details).
OL-6109-01
Advertisement
