4 Replies Latest reply on Jul 2, 2018 4:24 PM by rschroeder

    Netflow report for bandwidth or utilization between source and destination

    ranwe@taldor.co.il

      Hi

      I need to create a report for the Netflow data, that will show me the amount of data passed between source and destination, for example, the amount of data (in bytes) passed between an IP in the organization and the mail server in the last 7 days or 24 hours, or any IP to any application. I did not find something like that in the reports, or I missed it if it is there.

       

      Any Idea?

       

      Thanks in advance and regards

       

      Ran  

        • Re: Netflow report for bandwidth or utilization between source and destination
          rschroeder

          Netflow Traffic Analyzer has that reporting view built-in. 

           

          Start up Solarwinds, go to My Dashboards, select Netflow, then select Conversations:

           

          Once there, enter in the IP address of the source or destination device in the Search field, select "Endpoint IP Address".

           

          You can set other criteria, too--such as the time frame in which to search.

           

          Once you have one end of the conversation, you should be able to open the nodes/routers that participated with this node, and then just find the other one in the conversations you're interested in.

          • Re: Netflow report for bandwidth or utilization between source and destination
            rschroeder

            There are a number of identical requests out there for this.  Check them out here, and see which (if any) have solutions you might make work in your environment:

             

             

            In my environment we rely on proxy filters to track traffic that travels North-South (access PC to Internet), and we use Gigamon network taps to capture East-West traffic (PC-to-PC or PC-to-Server) that does not travel through a firewall or proxy server.

             

            Obviously, anything that passes through a firewall is much easier to see and report on.

             

            I think the desire for an inexpensive, intuitive, and easy Netflow way of capturing East-West traffic, especially if it's within the same VLAN or on the same switch, is a popular wishlist item.

             

            After reviewing Thwack threads and searching through my own Solarwinds, I think the first option I pasted (above) is the right starting point.  I went through it as an exercise and it seems pretty much right on the money, as long as you're monitoring the right nodes or ports.

             

            Forgive me for stating the obvious, but you won't get any data if the desired traffic flow doesn't pass through any Layer 3 routing interfaces (such as connections between two PC's on the same switch that also use the same VLAN). 

             

            And also as obvious, you can only capture Netflow stats on L3 interfaces on which Netflow reporting is enabled. 

             

            Let us know what you come up with.  If you can improve on the first option (above) with screen shots of what worked well for your specific case, please share them here so others can benefit from your new knowledge!

             

            Swift packets!

             

            Rick Schroeder