Sensors and Troubleshooting › CA Network Flow Analysis Sensors › High and Variable Volume-Out

High and Variable Volume-Out

The High and Variable Volume-Out sensor tracks host volume and detects sudden changes in server output. These changes may indicate server misconfiguration, virus infection, or unauthorized activity, such as BitTorrent server activity. These conditions produce a secondary type of alert, which typically occurs with another type of anomaly.

Troubleshooting a High and Variable Volume-Out Alert

An alert from the High and Variable Volume-Out sensor may indicate one of the following issues:

• Server misconfiguration.

  Find the source of the anomalous traffic and investigate the activity.

• A new authorized or unauthorized application that is deployed on the network.

  Find the source and investigate. Such behavior may indicate the presence of a BitTorrent or other peer-to-peer file-sharing server.

  Peer-to-peer file-sharing or other unauthorized activity often consumes excessive network resources. This type of activity potentially can expose your enterprise to copyright-infringement legal action.