admin/geedge-jira
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
795018e8e5791cb6edc865b1b4920fcd1294f457
geedge-jira/md/OMPUB-576.md

193 lines
7.0 KiB
Markdown
Raw Normal View History

first
2025-09-14 21:52:36 +00:00
# 【E21现场】业主新需求：订制report estimation one day 在IGW站点YouTube、Facebook、Twitter的流量及用户数
| ID | Creation Date | Assignee | Status |
|----|----------------|----------|--------|
| OMPUB-576 | 2022-08-04T21:55:36.000+0800 | 刘洋 | 完成 |
---
业主新需求：订制report估计one day  在IGW站点YouTube、Facebook、Twitter的流量及用户数，要求是至少能估计出流量和用户数的量级
 
处理进展：
已告知E现场没有接入radius的流量，不能按subscriber_ID统计，是否可以按client ip进行统计，业主表示可以接受。
制作report时遇到的问题和疑惑：
1、配置Datasets时group by  是只按application label = "facebook"统计就ok，还是要考虑ssl.sni like "%facebook%",因为查看session records 时发现存在ssl.sni like "%facebook%" AND application label != "facebook"的情况。
2、Datasets 配置只配置group by  application label ，application label = "facebook" 配置report，report查询一天的结果为：
IGW  YouTube  client ip num:64731
IGW 、PE、GGSN所有站点 YouTube  client ip num：613560.
IGW client ip 在总的占比接近10%。
针对统计的结果，这个统计数值是否正确，是否可以将这个report的数据提供给用户。
 
针对问题1和问题2相关统计和截图见附件
 **liuyang** commented on *2022-08-12T10:26:43.588+0800*:
对于问题1：因为对于facebook等应用识别不仅仅根据SSL.SNI字段，可能：
* SSL.SNI包含facebook的流量可能是其他应用引用的资源；
* APP特征库不完全，对Facebook等应用识别有漏掉；
所以如果[~liuju] 有时间可以捕获一些数据包以便我们进一步分析：在security event中，过滤policy id=该策略ID &&AND application label != "facebook"的日志，捕获一些满足条件的数据包后该策略就可以停止。然后下载pcap包通过MM发给[~fengweihao] 进一步查看。
!image-2022-08-12-10-20-11-144.png|width=319,height=318!
 
 
---
**liuyang** commented on *2022-08-12T10:36:24.221+0800*:
对于问题2：
* IGW和（PE+GGSN） Client IP多少说明：[~liuju] 已经帮忙导出PE日志中Client IP信息，[~liuxueli] 查看发现PE局点很多client ip是内网IP，所以IGW统计去重后的client ip数量少于PE和GGSN统计去重后的client ip数量是正常的。
* IGW和（PE+GGSN）Client IP占比说明：请[~liuxueli]  [~qidaijie] 帮忙查看report设置是否有问题，为什么report得到的结果和直接导回日志结果差距这么大？
** [~liuju] 帮忙做报告统计各局点去重后client ip总数和去重后内网client ip总数，发现各站点内网client ip占比平均约为12.89%。
** [~liuju] 帮忙导回BOL-PE和OAP-PE 5分钟session records，client ip去重后，内网IP占比分别为85.31%和92.80%
附件说明：
* client ip.pdf 统计的是全网各局点（16个）去重后client ip数量（包括内网和公网地址）
* intranet client ip 统计的是全网各局点（16个）内网 client ip去重数量。
* 注：BJR-IGW 数量极少的主要原因是因为BJR-IGW 的session records数据今天刚才处理恢复数据。
---
**qidaijie** commented on *2022-10-25T15:21:56.478+0800*:
对各Device Group独立客户端数量及内网独立客户端数量进行查询，时间为2022-10-20一天，查询内网IP条件与附件报表截图一致。
# 当指定application label为facebook时，统计结果为： [^Device Group独立客户端-Facebook.xlsx]
# 不指定application label时，统计结果为： [^Device Group独立客户端.xlsx]
通过结果总体来看：
# IGW和PE+GGSN的独立客户端数量相差不多。
# 当Application Label是facebook时：
## PE+GGSN的内网IP非常多 占比基本在95%以上。
## IGW几乎没有内网IP 占比不到1%。
---
attachment link
2025-09-14 22:26:17 +00:00
# Attachments
first
2025-09-14 21:52:36 +00:00
attachment link
2025-09-14 22:26:17 +00:00
Attachment: chart+library.png
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
![chart+library.png](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/30358/chart+library.png)
first
2025-09-14 21:52:36 +00:00
attachment link
2025-09-14 22:26:17 +00:00
Attachment: Client+ip++(1).pdf
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
[Client+ip++(1).pdf](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/30361/Client+ip++(1).pdf)
first
2025-09-14 21:52:36 +00:00
attachment link
2025-09-14 22:26:17 +00:00
Attachment: client+ip总数report.png
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
![client+ip总数report.png](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/30357/client+ip总数report.png)
first
2025-09-14 21:52:36 +00:00
attachment link
2025-09-14 22:26:17 +00:00
Attachment: dataset.png
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
![dataset.png](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/30359/dataset.png)
first
2025-09-14 21:52:36 +00:00
attachment link
2025-09-14 22:26:17 +00:00
Attachment: Device+Group独立客户端.xlsx
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
[Device+Group独立客户端.xlsx](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/32105/Device+Group独立客户端.xlsx)
first
2025-09-14 21:52:36 +00:00
attachment link
2025-09-14 22:26:17 +00:00
Attachment: Device+Group独立客户端-Facebook.xlsx
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
[Device+Group独立客户端-Facebook.xlsx](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/32106/Device+Group独立客户端-Facebook.xlsx)
first
2025-09-14 21:52:36 +00:00
attachment link
2025-09-14 22:26:17 +00:00
Attachment: image-2022-08-12-10-20-11-144.png
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
![image-2022-08-12-10-20-11-144.png](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/30349/image-2022-08-12-10-20-11-144.png)
first
2025-09-14 21:52:36 +00:00
attachment link
2025-09-14 22:26:17 +00:00
Attachment: image-2022-08-12-18-56-45-913.png
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
![image-2022-08-12-18-56-45-913.png](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/30401/image-2022-08-12-18-56-45-913.png)
first
2025-09-14 21:52:36 +00:00
attachment link
2025-09-14 22:26:17 +00:00
Attachment: intranet+client+ip+(1).pdf
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
[intranet+client+ip+(1).pdf](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/30360/intranet+client+ip+(1).pdf)
first
2025-09-14 21:52:36 +00:00
attachment link
2025-09-14 22:26:17 +00:00
Attachment: 内网client+ip过滤条件+report.png
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
![内网client+ip过滤条件+report.png](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/30356/内网client+ip过滤条件+report.png)
first
2025-09-14 21:52:36 +00:00
attachment link
2025-09-14 22:26:17 +00:00
Attachment: 内网client+ip过滤条件+report2.png
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
![内网client+ip过滤条件+report2.png](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/30355/内网client+ip过滤条件+report2.png)
first
2025-09-14 21:52:36 +00:00
attachment link
2025-09-14 22:26:17 +00:00
Attachment: 内网client+ip过滤条件+report3.png
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
![内网client+ip过滤条件+report3.png](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/30354/内网client+ip过滤条件+report3.png)
Attachment: 微信图片_20220804165125.png
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
![微信图片_20220804165125.png](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/30122/微信图片_20220804165125.png)
Attachment: 微信图片_20220804165143.png
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
![微信图片_20220804165143.png](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/30123/微信图片_20220804165143.png)
Attachment: 微信图片_20220804165148.png
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
![微信图片_20220804165148.png](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/30124/微信图片_20220804165148.png)
Attachment: 微信图片_20220804165156.png
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
![微信图片_20220804165156.png](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/30125/微信图片_20220804165156.png)
Attachment: 微信图片_20220804165203.png
attachment link
2025-09-14 22:27:11 +00:00
attachment link
2025-09-14 22:26:17 +00:00
![微信图片_20220804165203.png](https://gfwleak.exec.li/admin/geedge-jira/raw/branch/master/attachment/30126/微信图片_20220804165203.png)
first
2025-09-14 21:52:36 +00:00
Reference in New Issue Copy Permalink