Is it possible to creat an aleret when traffic load on an interface goes much higher than normal?

Question

I would like to be alerted when an interface gets a much higher spike in traffic than we normally see so we can check for DoS attacks or some large copy of files headed outbound.  I know the dashboard already has data for traffic averages or highest traffic IP device. The difficulty would be the logical comparision of traffic at any give time with the average traffic on that port at that approx time.

John-AVUSD · Answer

Thanks. mesverrum.  That all good info.  I'll dig into it.

mesverrum · Answer

There are a few built in ways to handle time of day stuff.  You can set a schedule on the alert itself, so its only active during specific time periods, or you can set a schedule on the individual alert actions, so you might have it send an email during business house and trigger a page after hours.

There's also the new HCO feature of anomaly based alerting which sounds similar to what you are aiming for. It works by shipping the behavior data to SW and they crunch the anomaly detection math for you since it takes a kind of ridiculous amount of resources to do any serious ML pattern detection locally.

I've also done some pretty hacky work arounds over the years using custom SQL tables to do pattern analysis, basically creating tables to store the historical time of day patterns and then joining that with current data to see if and by how much we are outside the trend.  That gets way into the weeds doing heavy database customization so I think most people are not motivated to roll their own anomaly engine.

John-AVUSD · Answer

I have our wan ports monitored and an alert that would trigger if the transmit or recieve percentage goes above a given amount. That certainly would alert on higher volumn.  What I was hoping for is catching not just a high volume trend, but something out of the norm. For instance, over night we have much less traffic thant during school hours, but if we get a surge that might be OK during the day but not normal traffic flow for off ours, I would want an alert. Is there an OID that reports time? I could use the time of day as part of the trigger conditions.