# Naming Custom Applications ## Overview When you deploy Traffic Insights, the system automatically classifies network traffic based on standard application recognition engines like Cisco NBAR (Network-Based Application Recognition). However, your organization may run proprietary or internal applications that these default recognition tools cannot identify. This creates blind spots in your traffic visibility; traffic appears as "Unknown" or gets classified by transport protocol (such as HTTP or UDP) rather than by your actual application name. The custom applications feature enables you to classify traffic relating to proprietary applications based on the traffic's destination IP address, subnets (CIDR ranges), transport protocols, and port numbers. Once you create custom application rules, Traffic Insights treats them like any other application (see [Conflict Resolution and Rule Prioritization](#conflict-resolution-and-rule-prioritization) for more information). They appear in stacked charts, dashboards, alerts, and all other visualizations with the same functionality as natively recognized applications. ## Scope Custom applications focus on Layer 3/Layer 4 classification and do not replace the deep packet inspection capabilities of Cisco NBAR or similar tools. {% hint style="info" %} The custom application feature relies on IP addresses, protocols, and ports. It does not currently support classification based on DNS hostnames or server names. {% endhint %} ## Limits Each account has the following constraints: * Maximum 1,000 unique application names across all custom application rules. * Maximum 20,000 unique CIDRs across all custom application rules. ## Creating Custom Applications There are two ways to open the custom application configuration form: 1. Navigate to **Traffic Insights > Settings > Custom Applications** and click **+ Add New Custom Application** in the top right. 2. In **Traffic Insights > Views**, select **View By: Conversations**, then click **Create Custom Application** from the ellipsis (**...**) menu on a table row. This opens the configuration form in a separate tab. On the configuration form, complete the following fields: * **Application Name**: Enter a meaningful name for your application. This is the name that appears in Traffic Insights visualizations. Maximum length is 79 characters. * **Description** (optional): Provide additional context about the application or its purpose. Maximum length is 256 characters. * **Rules**: Define up to eight rules that identify your custom application. Each rule specifies the network parameters that trigger classification as this application. For all fields, allowed characters include uppercase letters (A-Z), lowercase letters (a-z), numbers (0-9), and the following special characters: `.`, `:`, `/`, `=`, `+`, `-`, `@`, `_`. For each rule, configure: * **CIDR**: Enter up to eight IP addresses or CIDR ranges. You can mix IPv4 and IPv6 in the same application. Enter multiple values separated by commas or semicolons. Use `0.0.0.0/0` to match all IPv4 addresses or `::/0` for all IPv6 addresses. All CIDRs within a single rule must be unique: duplicate CIDRs within the same rule result in an error. When you specify server port ranges, all CIDRs are assumed to apply to the server side. * **Transport Protocol**: Select IP, TCP, UDP, or TCP-UDP. If you specify any protocol other than IP, you must also specify server port ranges. If you select IP, the rule applies to all protocols and all ports (both client and server) for the specified IP ranges. * **Server Port Ranges**: Server port ranges are required for all protocols except IP, for which they are optional. Enter up to eight port values separated by commas. You can specify individual ports (for example, 80, 443) or ranges (for example, 8000-8100). Port values must be integers between 1 and 65535 (inclusive). No two port ranges within the same rule may overlap (for example, 10-20 and 15-25 is an invalid combination). {% hint style="info" %} You may see error validation messages if you have not input a required field or have created identical rules. See [Conflict Resolution and Rule Prioritization](#conflict-resolution-and-rule-prioritization) for more information. {% endhint %} Click **Save** to create the application. Changes only apply to future conversations and may take up to 10 minutes to appear. ## Rule Logic The system uses an `OR` logic between rules within a single custom application. This means a flow is classified with your custom application name if it matches any of your defined rules, not all of them. For example, if you create an application called "Internal Database" with three rules covering three different CIDR ranges, a flow matching just one of those ranges (and the corresponding protocol and port) will be classified as "Internal Database." ## Editing Custom Applications When you edit an existing custom application, the changes apply only to future traffic. Historical data that was classified under the previous rule remains unchanged. To edit a custom application: 1. Navigate to **Traffic Insights > Settings > Custom Applications**. 2. Locate the application in the list and select **Edit** from the ellipsis (**...**) menu on the right. 3. Modify the application name, description, or rules as needed. 4. Click **Save**. As with new rules, it may take up to 10 minutes for the updated classification to appear in your visualizations and dashboards. ## Deleting Custom Applications When you delete a custom application rule, future traffic is no longer classified by that rule. However, historical data previously classified with that application name retains its classification. Associated alerts and dashboards naturally fade out over time as new data accumulates and the retention period of 30 days expires. To delete a custom application: 1. Navigate to **Traffic Insights > Settings > Custom Applications**. 2. Locate the application you want to delete and select **Delete** from the ellipsis (**...**) menu on the right, or select multiple applications and delete in bulk using the **Delete** button at the bottom. 3. Confirm the deletion when prompted. ## Conflict Resolution and Rule Prioritization Traffic Insights prevents configuration conflicts and prioritizes certain rules by validating your rules during creation, editing, and flow enrichment. ### During Configuration If you attempt to create or edit a rule that exactly matches an existing rule in another custom application, you'll see an error message. This prevents the configuration from being saved. An exact match conflict occurs when: * The set of CIDR ranges for the new rule is identical to that of an existing rule. * The protocols are compatible. For example, a new rule with protocol TCP conflicts with existing rules having TCP or TCP-UDP protocols. * The port ranges match, or both rules have no port restrictions (null or empty port ranges). * If one rule has port restrictions and another does not, they are not considered an exact match conflict. **Example**: If "App A" has a rule for `192.168.1.0/24` on TCP port 8080, you cannot create a rule in "App B" for the same IP range and protocol/port combination. ### During Flow Classification Configuration validation prevents exact match conflicts (identical CIDR ranges, protocols, and ports across different custom applications), but overlapping CIDR ranges are permitted. If a flow matches multiple custom applications due to overlapping CIDR ranges, the system prioritizes the application with the longest (most specific) CIDR prefix match. For example, if you have rules for both 10.10.10.10/32 and 10.10.10.0/24, a flow to 10.10.10.10 will be classified by the /32 rule since it is more specific. The system applies this consistent decision logic to ensure the same application name is used for the same IP/protocol/port combination every time, regardless of rule evaluation order. Additionally, IP+Port rules (rules that specify both IP ranges and ports) always take precedence over IP-only rules (rules that specify only IP ranges). ### During Flow Enrichment If an application name sent by Cisco NBAR or another system-level enrichment exactly matches a custom application name you have created, Traffic Insights treats them as the same application. This enables two important use cases: extending enriched classifications and overriding enriched classifications. #### Extending Enriched Classifications You can use custom applications to extend enrichment engines' (such as Cisco NBAR's) reach by classifying traffic from IP addresses that NBAR does not recognize. For example, if you know a server supports Microsoft 365 but NBAR does not automatically classify it as such, you can create the classification yourself, allowing Traffic Insights to group that server in with other Microsoft 365 servers that NBAR does recognize. When you extend NBAR classification, the custom application does not conflict with any previous classification because the IP address was already unclassified. The result is a unified view of the application (in this example, Microsoft 365) across both NBAR-recognized and custom-defined traffic sources. #### Overriding Enriched Classifications You can also use custom applications to override, for example, NBAR's classification when NBAR recognizes an application but you want to classify it differently. This allows you to reclassify traffic according to your organization's specific needs. For example, if NBAR classifies traffic as "Microsoft 365" but your organization categorizes its use of Microsoft 365 as "Internal Ops", you can create a custom application with the same name as your internal system and map it to the IP ranges and ports NBAR is currently classifying as "Microsoft 365." Future traffic matching your custom application rules will be classified under your custom application name ("Internal Ops") instead of the NBAR classification ("Microsoft 365"). ## How Flows Are Matched When matching flows, the system performs a two-directional lookup: * **Source Direction**: Checks if the flow's source IP and source port match your rule's IP ranges and port ranges. * **Destination Direction**: Checks if the flow's destination IP and destination port match your rule's IP ranges and port ranges. A match in either direction classifies the flow with your custom application name. ## Viewing Your Custom Applications You can find all configured applications at **Traffic Insights > Settings > Custom Applications**. The table displays the following columns: * **Application Name**: The name you assigned. * **Description**: Any optional description you added. * **Rules**: The number of rules defined for this application. * **Number of Conversations (past 7 days)**: The count of network flows classified with this application in the last seven days, based on active data collection. Use the search bar or filters to quickly locate specific applications. Click on a custom application in the list to open it in **Traffic Insights > Views**, filtered to that application only. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.thousandeyes.com/product-documentation/traffic-insights/traffic-insights-configuration-guide/naming-custom-applications.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.