These reports represents three NTA resources "Top XX IP Address Groups", "Top XX Source IP Address Groups" and "Top XX Destination IP Address Groups".
It shows 95th percentile bandwidth utilization.
Report presents source/destination and Ingress/Egress traffic:
- Ingress/Egress flow traffic per interface.
- Source/Destination traffic is traffic between two endpoints (source IP and destination IP).
Destination traffic means that Endpoints which belongs to IP address group were receiving traffic from others ( traffic which was sent to IP address group).
For Source traffic it means that Endpoints from IP address group were sending data to others ( traffic received by Group).
Source and Destination traffic is than divided to Ingress and Egress. So there is possible to see Source/Destination traffic via interfaces in Ingress or Egress flow direction
Report can also display nodes together with interfaces, nodes only or overall summaries. Check report SQL header section for possible filters choices.
Modify parameters @StartTime,@EndTime,@ConversationIPs,@Expand,@InterfaceIDs,@GroupIDs to customize reports to your needs.
SET @StartTime = GETDATE()-30 -- start 30 days ago
SET @EndTime = CAST((FLOOR((CAST(GETDATE() AS float)+5e-6))) AS smalldatetime) --end last midnight
SET @ConversationIPs = '10140106001-10140106002,10140106002-10140106001'
-- include only traffic from Source IP 10.140.106.1 to Destination IP 10.140.106.2
-- and back from 10.140.106.2 to 10.140.106.1
-- fully expanded report-most detailed
-- to nodes level 'ExpandToNodes'
-- without any expansion 'NoExpand'
SET @InterfaceIDs=' 1,2,10,21 '
-- filter report for interfaces with InterfaceID 1,2,10,21
-- InterfaceID can be extracted from netflow source resource
-- InterfaceID on web site is market with char I. example "I:1"
SET @GroupIDs = ' Private addresses, MyWebServer,MyDNSServer '
-- filter report by defined IP address Groups Name