Digging Deeper into Netflow Data

I have netflow data coming from several sources & I am wanting to see what the itemized endpoints are for the top users. I see the top 5. For the first 5 I get addresses and the rest just go to 'Remaining Traffic' how can I retrieve data, if possible, from NTA to see what the rest of the netfow data looks like? Is it pre-compiled in the database as 'remaining traffic' or is that just on the report? 

Thanks for any help or suggestions!

  • The quick solution is just to edit the widget and change it from top 5 to a higher number. I go top 25 on many of my details widgets
  • Hi  

    Thanks for the response. This will help out some. I assume that the netflow data we capture with solarwinds is viewable in full until the 30 day expulsion period set (by default, in our case). We had a large influx of traffic, not sure if it was a DDOS or not yet, but are wanting to see if we can see where exactly the traffic came from. It looks like it would require more than the 25 results, even. 

    Do you or any others happen to know how we can parse through this data?

  • There's a built in report of top 100, you can modify that and remove the top xx bits but reporting on netflow can time out when you try to present too much data in a single go. When you need a really big chunk you can use SSMS to write queries directly against the netflow database since there is no timeout built into sql it'll just keep going until it's done.