Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 15

Feature request

Thanks for the great news Josh, I haven't even seen the new NetFlow product yet, but here's my first request (assuming this feature is not already built in). We have a requirement to log & trend the number of users (IP addresses) connecting to a server or application over time. None of the Netflow products I have tested have this capability. Here is an example: Graph the number(count) of unique IP addresses connecting to webserver every 5 minutes & save this data for a year. Basically just a count of the IPs or TCP/UDP ports every 5 minutes. All other NetFlow software can give Kbps, %Utilization &/or display the actual IPs, but cannot give a count of IP's or TCP/UDP connections over time. Ideally you would be able to create filters based on Subnet, so that you could trend the users based on location. Here's a few more report examples:
  • Graph the number of unique TCP connections to my application server from the western call center (all IP's in Subnet in 5 minute intervals over the last 7 days (When are my highest call volumes for the West)
  • Graph the number of VPN users (all IP's in Subnet that are connected through this router interface in 5 minute increments for the past year (Trend VPN usage)
  • Graph the number of unique IP's connecting to my Internet Web server on TCP port 80 in 1 hour intervals over the past 30 days (How many hits am I getting on my webserver & from where)
Using Netflow to monitor application usage based on number of connections over time, would be a very powerful feature, which could easily replace many other reporting tools. -=Cheers=- NG
0 Kudos
2 Replies
Level 15

Hi Denny,

We are trying to use this information to track utilization & traffic patterns of application servers. This is would be used for reporting/capacity management & troubleshooting purposes.

As an example, we have a DB server which regularily sees 100% CPU utilization for during the weekday.
Using Netflow to track the number of network connections to the DB over time, we can better relate this the CPU load.
The server had been recently patched to resolve this issue, but the CPU is still peaking at 100%. By viewing the Number od DB connections before & after the upgrade, we would be able to see if the patch increased the capacity or not.

Another example would be historical troubleshooting (analyzing outages & degradations). Normal traffic patterns might show 1000 connections to an application server during business hours. If the number of connections changes dramatically, we can drill down to see which Call Center (IP subnet) is outside the norm.
We have had application outages blamed on the network.
With this tool we can see the network connections to a particular server dropped while staying up to another server, proving the WAN connection from client to server was not the cause of thr outage.
We can also use it for trending. What is the growth trend of an application based on number of network connections?
Can we add another 200 users in our Western call center based on current application usage without adding another server?

0 Kudos
Level 19


You said that tracking logins to a server was a requirement on your group. Who generated the requrirement? Security team? Regulatory compliance/auditors? Understanding that can help us to figure how widely such a feature would apply.


Denny LeCompte
Sr. Product Manager, Orion
0 Kudos