30. Reports » Tools » Flows

Reports » Tools contains a link to the Flows item only when there is at least one Flow Sensor defined. Here you can list, aggregate, filter and sort flow records, or generate traffic tops and statistics.

There are 2 sub-tabs, located at the left lower side of the window:

30.1. Flow Records

Here you can list and filter flow data.

● Sensor Interfaces – Select the interfaces you are interested in. Administrators can restrict the interfaces visible by guest accounts

● Flow Filtering Expression – Here you can enter a filtering expression for flows. Click the star icon on the right to open a window that shows you the correct syntax. Frequently-used filtering expressions can be saved there and reused at any later time

● Export – If the output is not very large, it can be viewed in several formats such as HTML, TXT, JSON or CSV, converted to PDF, emailed or printed. If you need to list huge amounts of flow data, doing it solely from the web browser may not be a good idea because the page will timeout after a few minutes. In this case, select the “CLI” option to view the shell command used for listing flows. You can then execute the command from the shell and forward the output to a file

● Time Range – Select a predefined time range, or select “Custom…” to enter a specific time interval, in order to list flows that started or ended inside that interval. Time zone differences between the Console server and remote Flow Sensor servers are not adjusted automatically

● Limit – Show only the first N flows

● Aggregation – By default, flows are not aggregated. By checking the appropriate options, you can select how to aggregate flows. You can aggregate entire subnets by selecting src(dst)IPv4(IPv6)/<subnet bits>

● Sorting – When listing flows sent from different interfaces, you can sort them after to the start time of the flows. Otherwise, flows are listed in the sequence of the selected interfaces

● Display – You can select several predefined output formats, or you can enter your own format by selecting “Custom…”. Each predefined output format changes the options from the Display Options menu

● Display Options – Here you can select how to display several columns. Select the Include Unmonitored Ifs checkbox if you want to include flow data generated by the interfaces that are not monitored by Flow Sensor

30.2. Flow Tops

Here you can generate tops from flow data.

● Sensor Interfaces – Select the interfaces you are interested in. Administrators can restrict the interfaces visible by guest accounts

● Flow Filtering Expression – Here you can enter a filtering expression for flows. Click the star icon on the right to open a window that shows you the correct syntax. Frequently-used filtering expressions can be saved there and reused at any later time

● Top Type – Select the desired top type from the drop-down menu

● Order By – Select the sorting unit

● Export – If the output is not very large, it can be viewed in several formats such as HTML, TXT, JSON or CSV, converted to PDF, emailed or printed. If you need to list huge amounts of top data, doing it solely from the web browser may not be a good idea because the page will timeout after a few minutes. In this case, select the “CLI” option to view the shell command used for generating the top. You can then execute the command from the shell and forward the output to a file

● Time Range – Select a predefined time range, or select “Custom…” to enter a specific time interval, in order to count only flows that started or ended inside the interval. Time zone differences between the Console server and remote Flow Sensor servers are not adjusted automatically

● Top – Limit the top listing to the first N records

● Aggregation – By default, flows are not aggregated. By checking the appropriate options, you can select how to aggregate flows. You can aggregate entire subnets by selecting src(dst)IPv4(IPv6)/<subnet bits>

● Limit – Limit the output to only those records whose packets or bytes match the specified condition

● Display – You can select several predefined output formats, or you can enter your own format by selecting “Custom…”. Each predefined output format changes the options from the Display Options menu

● Display Options – Here you can select how to display several columns. Select the Include Unmonitored Ifs checkbox if you want to include flow data generated by the interfaces that are not monitored by Flow Sensor