[Data Sheet]
NSFOCUS ADS-M System
Overview
What does ADS-M do?

Centrally manage ADS
devices and regions

Policy enforcement

Monitoring for traffic and
device

Report
Where is ADS-M for?

Large-scale IDCs/ISPs

Enterprise networks

Carrier backbone networks
Nowadays, more and more Internet Service Providers (ISPs) are inclined to
depend on large-scale anti-DDoS systems to protect against attacks in a
controllable manner. To cater for this requirement, NSFOCUS launched
NSFOCUS Clean Matrix system, an integrated solution that consists of
anomaly traffic detection system, anomaly traffic cleaning system and
centralized management & forensics system.
ADS-M (ADS –M for short) management and forensics system is used to
collect status data from different locations in the network to make
correlation analysis for taking corresponding processing, efficiently manage
user-groups that are customized based on logic objects (such as protection
group and traffic group), provide many types of reports separately to each
group, centrally configure prevention/monitoring devices located in
different nodes and assign privileges, and capture packets for forensics
purpose.
Features
What to work with?

ADS system
Centralized Management

NTA, Network Traffic
Analysis
Centrally configure parameters and security policies, and uniformly
distribute configuration documents for all ADS devices and NTA devices.
Security Policy
ADS-M helps the network administrator to centrally manage all ADS devices
and configure various prevention policies for them. Policy templates are
used to granularly configure policies. For example, specific attack methods
can be used to select the most effective prevention algorithms if the attacks
are of the same type. Policy distribution ensures that the latest security
policy is sent to the corresponding ADS devices. It also supports
configuration for the detection policies of NTA devices.
1/8
[Data Sheet]
Customized Business Domain
Features
ADS-M categorizes the targets to be protected and the devices to implement
protection into different business domains per customers, physical
deployment, service difference or other customized demands. It presents a
security configuration view of the objects to be protected, to facilitate
security maintenance. With the help of the ADS-M, the administrator can
centrally configure and manage these business domains on all ADS devices.
ADS-M can also distribute the business domain policies to NTA.

Centralized Management

Security Policy

Customized Region

Packet Capturing

Centralized Monitoring

Traffic analysis

Report System

Log Enquiry
ADS-M has an internal abnormal traffic analysis module. By leveraging
NetFlow technology and advanced traffic baseline algorithms, ADS-M
addresses a wide range of external and internal security threats for
customers with traffic statistics and analysis and abnormal traffic detection.

Multistage Privilege Levels
Packet Capturing
Traffic Analysis
With growing loss resulted from the extension of DDoS attacks and increase
of attack frequency, users began to have the awareness of tracing attack
sources. As one of the victims, the telecom carriers are also eager to find out
the sources of attacks. Besides, e-discovery can be considered as additional
value in business. As shown in Figure 3.1, the ADS-M sends the capture task
to the ADS, from which data packets complying with the capture conditions
will be duplicated and sent to the ADS-M for evidence to deter DDoS
attacks.
2/8
[Data Sheet]
ADS-M Packet Capturing Management
Centralized Device Monitoring
NSFOCUS ADS-M monitors the CPU usage rate, port status, memory usage
rate, traffic passing by the ports and network status, provides real-time
traffic monitoring and Top N statistic information in the latest 30 minutes,
and monitors devices according to traffic alerts and performance alerts.
Report System
Based on powerful statistic function, NSFOCUS ADS-M provides diversified
types of reports to satisfy all requirements in operation and maintenance.
Report System contains traffic report, security report, attack event report
and integrated report. Traffic report provides statistic information about
traffic trends, protocol trends, TCP package trends, attack types, protocol
types, TCP package types, attack targets and attack ports. Security report
focuses on statistic information about alert periods and alert types. The
attack event report describes the attack events happened or happening.
Integrated report concludes the status of the entire network, including
network operation, device performance and network alert, after which an
analysis result is generated.
Log Enquiry
3/8
Log Enquiry
The users are allowed to view the logs of all the ADS devices including the
[Data Sheet]
The users can view the logs about all ADS devices and NTA devices. The log
about ADS device logs contain attack logs, login logs, operation logs, data
link status logs and performance logs. The log about NTA devices records
attack summary logs , login and logout logs, operation logs, link state logs,
diversion logs, performance logs, operation alert logs, HA logs, and traffic
alert logs.
Diversion

BGP

OSPF
Re-injection

PBR

GRE

MPLS

VLAN
By inquiring the self-audited logs of the ADS-M, the information about login
and operation behaviors can be viewed by users, fully embodying the
controllability of the ADS-M.
Multistage Privilege Levels
Multistage privilege levels are classified to manage different users accessing
to the ADS-M. There are three groups: Supervisor, Administrator and
Common User. The Supervisor is held by the admin, the only default user;
those who hold “Administrator” privilege are in charge of the daily
maintenance of the system; Common Users are people who use system to
analyze but not allowed to set any values to the system. Multistage and
Multi-privilege Management enables the enhancement of self-security, and
complies with users’ practice in operation and maintenance.
Deployment Scenario
Traffic Diversion Deployment with NTA
In systems of IDCs, ICPs, or other system with crucial businesses, traffic
diversion technique is used in NSFOCUS ADS to protect against anomaly
traffic. NTA, the traffic detection appliance, is generally deployed at any
position of the network, but the ADS is deployed at the ingress
out-of-the-path network. NTA detects incoming traffic at the network
ingress and alerts the ADS if anomaly traffic is discovered. After receiving
the alert, ADS starts to divert the traffic from the core router or the switch
and filter out the anomaly traffic. And then, the clean traffic will be
re-injected into the mainstream of the network and sent to its destination.
In this solution, ADS-M system is designed to establish control and data
channels for both ADS and NTA systems, monitor device status in real time,
collect and analyze attack information, and modify and distribute policy
configuration or device operation and maintenance information to all ADS
devices. It is a centralized management center integrating monitoring,
control, statistics, analysis, configuration management and user
management together.
4/8
[Data Sheet]
ADS traffic diversion deployment
Traffic Diversion Deployment with Internal traffic analysis
With internal traffic analysis module, ADS-M detects incoming traffic and
alerts the ADS if anomaly traffic is discovered instead of NTA. In this solution,
ADS-M system is designed to establish control and data channels for ADS
systems, monitor both traffic and device status in real time, collect and
analyze attack information, and modify and distribute policy configuration or
device operation and maintenance information to all ADS devices.
ADS traffic diversion deployment with internal traffic analysis
5/8
[Data Sheet]
Functions
The following table describes the main functions of ADS-M 1600:
Function
Functions

System Monitoring

Traffic analysis

Statistical Reports

Logs

Centralized Management
and Configuration

Region & User Management
Description
System
Device status monitoring
Monitoring
Traffic and performance alert
Traffic analysis
DDoS Attacks
ADS M-1600
Y
Y
Attack event report, traffic trend
Statistical
report, TopN traffic report,
Reports
integrated report, attack summary
Y
report
Attack summary logs, login and
logout logs, operation logs, link state
Logs
logs, diversion logs, performance
Y
logs, operation alert logs, HA logs,
and traffic alert logs
Add /delete devices
Configure devices
Centralized
Management
&Configuration
Configure policies
Traffic diversion
Re-injection management
Y
Forensic analysis
ADS clustering
HA function
Region & User
Management
Region and user management
Y
6/8
[Data Sheet]
Performance
The following table describes performance of NSFOCUS ADS-M 1600:
Performance
Limitation
Statistical period
30 seconds
Max. managed devices
40*ADS and 20*NTA
Storage life
5 years
Initial data storage life
3 months
UI operation response
<10 seconds
delay
Policy operation delay
<10 seconds
Max. concurrent users
<50
Flow number
50,000/second
Max. region number
1024
Max. IP numbers for one
65,535
region
7/8
[Data Sheet]
For more information:
Hardware Specifications
For more information about
NSFOCUS products and services,
please contact the NSFOCUS
sales
The following table describes hardware specifications of NSFOCUS ADS-M
1600:
U.S.
TEL: +1 408 907 6638
Index
Interfaces
TEL: +44 (0)20 30786850
1*RJ45; 2*100/1000M copper; 4* 1000M SFP slots;
Single 1T hard disk
EMAIL: [email protected]
EMEA
ADS-M 1600
Weight
19 Kg
Dimension
443mm*512*88
EMAIL:
(W*D*H)
[email protected]
Rack
2U
APAC
Power Supply
AC, DC
TEL: +65 6809-3128
Power
400 W
EMAIL: [email protected]
Consumption
Japan
MTBF
60,000 hours
Operating
0-45℃ (32-113F)
TEL: +81 3 6206 8156
EMAIL: [email protected]
China
Temperature
Storage
-20-65℃
Temperature
TEL: +86 10-6843-8880
EMAIL: [email protected]
For more information visit
NSFOCUS Website:
www.nsfocus.com/en/
About NSFOCUS
http://www.nsfocus.com/en/
NSFOCUS is a proven global leader in active perimeter network security
for service providers, data centers, and corporations. It focuses on
providing network security solutions including: carrier-grade Anti-DDoS
System, Web Application Firewall, and Network Intrusion Prevention
System - all designed to help customers secure their networks and
corporate-critical information. More detailed information is available
at http://www.nsfocus.com..
“NSFOCUS” is the trademark of NSFOCUS
Information Technology Co., Ltd.
NSFOCUS enjoys all copyrights with respect
to all textual narrations, document formats,
illustrations,
photographs,
methods,
8/8