NTA Reporting on Network Impact of Internal Scans

FormerMember

Our Director of Information Security will be doing to internal scans on the network to find printers.  He has asked that I report the impact on the internal network during the scans.  I am not exactly sure how to go about this as I have generally only used the netflow module to identify ingress/egress traffic at our edge.  Please help!  Thanks!

mesverrum

This is a pretty standard use case for IP Address Groups.  You can Define a group with all of the scanners IP Addresses in it and then display all the traffic originating or destined for that group.

These pages should get you started

IP address groups

IP Address Group Conversation Filtered View

-Marc Netterfield

    Loop1 Systems: SolarWinds Training and Professional Services

•                 LinkedIN: Loop1 Systems
•                 Facebook: Loop1 Systems
•                 Twitter: @Loop1Systems