Graphing conversations or endpoints without top 10 or with address groups

Question

Hello,

I am trying to use Netflow to determine how much data is being sent by various subnets in my environment across multiple netflow sources. In the NTA summary, there is a top 10 for endpoints and for conversations. The format of these graphs is exactly what I'm looking (shows rate of data transfer in bits per seconds).  I'd like to see the same graph but for IP address groups. When I change the view to IP address groups, it shows the total amount of data transferred within that period. Any thoughts on how to accomplish this?

mrt3385 · Answer

hi cnorborg, thanks for the reply. I tried that, and it limits the scope of the data to whatever is in your address group, THEN filters the graphs further by top 10 app, conversations, etc. I don't want just the top 10, I want to see all the traffic broken out by address group instead of conversation. I essentially want this graph:

with this breakdown of data (this snippet is from the top 10 ip address group destinations)

Right now, I can only get the top graph to do top XX.

cnorborg · Answer

Didn't wait long enough!  Changed the timeframe I was looking at from 1 hour to 15 minutes, and it appears to be working like a champ!!

cnorborg · Answer

There is a built in section in the Netflow Settings for IP address groups.  You can create your own groups and add your IP ranges, single IPs and subnets.   One group can have multiple ranges or whatever.

Then, in Netflow Traffic Analyzer Summary page, click on the "Flow Navigator" in the left side.  Go down to "IP Address Groups" and "Include" the group you just made.  In theory, it should now limit that page to just traffic from that group.   Might be able to link to the URL?  Not sure.

Just tried this myself, but it has yet to populate any traffic from the group I made, but in theory it should work?