This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Internet Destinations

Hi,  I need to write a report showing the total inbound bytes from the top 25 internet destinations.  How do I discriminate between internet destinations and addresses within my own company?  Is there a particular field that holds "http" or "www"?  What tables would I use to write such a query?

Thanks

  • So if you know the subnets that your company uses, then you can just filter directly in the NetFlowDetail & NetFlowSummary tables for what you want.  For instance:

    SELECT * FROM NetFlowSummary WHERE (SourceIPSort >= dbo.ConvertToIPSort('1.2.3.1') AND SourceIPSort <= dbo.ConvertToIPSort('1.2.3.255')) OR (DestIPSort >= dbo.ConvertToIPSort('1.2.3.1') AND DestIPSort <= dbo.ConvertToIPSort('1.2.3.255'))

    Or you can use the domain name of your company...

    SELECT * FROM NetFlowSummary JOIN FlowCorrelationPostDNS ON NetFlowSummary.SourceIPSort = FlowCorrelationPostDNS.IPAddresSort OR NetFlowSummary.DestIPSort = FlowCorrelationPostDNS.IPAddresSort WHERE Domain = 'solarwinds.com'

    In either case, if you want traffic that is only internal to your company, then just replace the 'OR' in the T-SQL queries above with 'AND'.

    Now, we don't store the URLs for web requests, because it isn't sent in the netflow traffic that is sent to us.  But what you can do is use the 'SourcePort' and 'DestPort' of the traffic to see if there is traffic on port 80, for example.

    Hopefully that gets you started.

    Thanks,

    David