1 Reply Latest reply on Apr 15, 2009 8:48 PM by davidmaltby

    Internet Destinations

      Hi,  I need to write a report showing the total inbound bytes from the top 25 internet destinations.  How do I discriminate between internet destinations and addresses within my own company?  Is there a particular field that holds "http" or "www"?  What tables would I use to write such a query?

      Thanks

        • Re: Internet Destinations
          davidmaltby

          So if you know the subnets that your company uses, then you can just filter directly in the NetFlowDetail & NetFlowSummary tables for what you want.  For instance:

          SELECT * FROM NetFlowSummary WHERE (SourceIPSort >= dbo.ConvertToIPSort('1.2.3.1') AND SourceIPSort <= dbo.ConvertToIPSort('1.2.3.255')) OR (DestIPSort >= dbo.ConvertToIPSort('1.2.3.1') AND DestIPSort <= dbo.ConvertToIPSort('1.2.3.255'))

          Or you can use the domain name of your company...

          SELECT * FROM NetFlowSummary JOIN FlowCorrelationPostDNS ON NetFlowSummary.SourceIPSort = FlowCorrelationPostDNS.IPAddresSort OR NetFlowSummary.DestIPSort = FlowCorrelationPostDNS.IPAddresSort WHERE Domain = 'solarwinds.com'

          In either case, if you want traffic that is only internal to your company, then just replace the 'OR' in the T-SQL queries above with 'AND'.

          Now, we don't store the URLs for web requests, because it isn't sent in the netflow traffic that is sent to us.  But what you can do is use the 'SourcePort' and 'DestPort' of the traffic to see if there is traffic on port 80, for example.

          Hopefully that gets you started.

          Thanks,

          David