Sensors and Troubleshooting › CA Network Flow Analysis Sensors › High and Variable Volume-In

High and Variable Volume-In

The High and Variable Volume-In sensor tracks host volume and detects sudden changes in incoming volume. These changes may indicate server misconfiguration, virus infection, or unauthorized activity, such as BitTorrent server activity. The activity produces a secondary type of alert, and it typically occurs together with another type of anomaly.

Troubleshooting a High and Variable Volume-In Alert

An alert from the High and Variable Volume-In sensor may indicate one of the following issues:

• Server misconfiguration.

  Find the source of the anomalous traffic and investigate the activity.

• A new authorized or unauthorized application that is deployed on the network.

  Find the source and investigate. The behavior may indicate the presence of a BitTorrent or other peer-to-peer file sharing server.

  Peer-to-peer file-sharing or other unauthorized activity often consumes excessive network resources. This type of activity potentially can expose your enterprise to copyright-infringement legal action.