Configuring a Failed Connections Threshold

Track devices experiencing failed, incomplete, or malformed connections. See port scanning, probing, and DoS attacks.

Configure a Network Traffic Analyzer failed connections threshold:

Name. Used in the Threshold library and the quick select title on the Alert Center Dashboard.
Notification Policy. (Optional) Select the notification policy to apply to this threshold. The policy initiates notifications when an item is outside the configured threshold limits.
Threshold Check Interval. Enter a time interval for Alert Center to check the Network Performance Monitor database for items that are out of the threshold limits.
Automatically resolve items no longer out of threshold. Select this option if you want Alert Center to automatically resolve items when they return to the value within the threshold limit

Note: Notification policies are optional for most thresholds. If you do not select a notification policy, no notifications are generated for the threshold, but a dashboard report listing the out of threshold items still appears on the Alert Center Home page.

Add Condition Rules

a host has... Select the direction(s) of traffic to consider.
more than... Select a magnitude (limit) for conversation partners.
in the past... Select a period for the measurement.

Select Applied Hosts

Note: Sources sending sampled data are not displayed as a selection option in the Traffic to monitor list because Network Traffic Analyzer cannot determine that traffic has failed on sampled data.

Traffic to monitor. By default, the threshold is set to monitor traffic from all Network Traffic Analyzer Sources. Select the Network Traffic Analyzer source or interface from which to monitor traffic. When you select a source, traffic for all interfaces on the source is monitored. When you select an interface, only traffic for the selected interface is monitored.
Tip: When you select a source, traffic for all interfaces on the source is monitored. When you select an interface, only traffic for the selected interface is monitored.
Hosts to monitor. By default, the threshold monitors all applicable hosts. You can also select IP ranges and IP Groups.
- All Hosts. By default, the threshold monitors all applicable hosts
  Exclude Hosts. Select to ignore the traffic for a list of hosts you assemble here.
- Specific Hosts. Click Apply this Threshold to Specific Hosts to choose the hosts to which the threshold applies.

Note: Configure the threshold check interval for a longer time than the sampling interval for thresholds relating to trends, such as percent utilization. Configure it for a time the same as (or similar to) the sampling interval when configuring a threshold for a health check.

Tip: Avoid setting the threshold check interval to a very short time. Aggressive intervals can degrade system performance. In general, setting the threshold check interval to less than five minutes is not advised.