Long term NetFlow analysis

Question

Hi all, I have a requirement to audit all flows in/out of a specific subnet for approx. 1 month. Can anyone give me a steer on how best to configure Solarwinds NetFlow and how I can generate a flat file listing all flows seen during the analysis period.

Thanks in advance,

Tim

ice · Answer

not sure if Orion SDK will work on this as NTA uses NTA flow storage database - which is non SQL database. Although it uses still 20% of the SQL database most of the data you will be looking is on the NTA flow storage database.

you can RDP to the NTA FSDB and got to program files and search for FASTBIT Studio.

johnny_ringo · Answer

Tim,

Have you looked at the Orion SDK?  It supports the flow tables and if you are familiar with SQL then it is the fastest and most granular way to get a file with the flow data you are looking for.  Just be careful to understand your retention settings if you need to generate this report for an auditing stand point.  If you need more help post an example of what you are trying to do and we can help you get to what you want.

https://thwack.solarwinds.com/community/labs_tht/orion-sdk

https://github.com/solarwinds/OrionSDK