Need to display all application ports being used to turn workstation firewalls back on

Question

Hi team, I'm trying to find a way of displaying all ports being used (weather or not it is tagged to a Application ) as I our current fleet have their Windows Domain firewall turned off and I want to turn it on.

We have all our floors switches come back to a core switch and this is being stored in solar winds using NTA and Netflow.

I've been working with the report writer and Netflow by connection but it doesn't seem to be giving me what I am after.

Example of report would be like this

PORT NumberCount of times seen2152801000000080801100054533352

Has any one created or seen a report like this and can give some advise on how to generate it as at the moment I'm struggling reaching this outcome

mesverrum · Answer

The nta stats aren't stored in the same sql db as the other stuff.  If you are running a version older than 4.4 it's stored in a proprietary database called the fastbit db, if you are running 4.4 then it's stored in a separate sql db.  In either case your best bet is to use swql studio to poke around since the information service will sort out those details for you.

johnw230873 · Answer

Thanks Mesverrum, I've spent about 30 mins looking at tables but I haven't found any that I can use to get the Netflow conversation from yet, do you know which tables these are?

mesverrum · Answer

I'd have to look at the database, but it could be that the field "sourceip" does not actually contain strings of IP addresses, it could be maybe an integer pointing back to the list of endpoints or something like that.  You could validate that idea by just entering a plain integer with no decimals and see if it thinks that is valid.  Within Solarwinds NTA I think the only way that works to make a query that would show you data across a range of ip's is actually to build an IP address group for that range, then filter your report against that group.