Installed NNA yesterday and added some sources to it. This thread is more for me to learn what it can do within the 60 day period.
First question is regarding the summary page, obviously I know you can drill further into the irrespective fields, but just want to confirm to what I'm looking at.
Is bytes the total of incoming & outgoing on the server interface and so for the other fields?
Anton @ CPB wrote:First question is regarding the summary page, obviously I know you can drill further into the irrespective fields, but just want to confirm to what I'm looking at.
Is bytes the total of incoming & outgoing on the server interface and so for the other fields?
This is only 1 question right? I'm not 100% sure I understand it but I'll do my best.
This graph appears to be a standard bandwidth graph on a source. If I'm right about that this is the cumulative bandwidth of all flows being recorded. If your source only has one server sending netflow data then it's simply the aggregated bandwidth (ingress and egress) for that server most likely. If the source is collecting data from multiple hosts then it's the aggregated bandwidth of all of them. If the device(s) submitting flow data are routers it will be the aggregated data of all the traffic you define as "interesting" on those routers.
jdalrymple wrote:If I'm right about that this is the cumulative bandwidth of all flows being recorded.
Correct
jdalrymple wrote:If your source only has one server sending netflow data then it's simply the aggregated bandwidth (ingress and egress) for that server most likely. If the source is collecting data from multiple hosts then it's the aggregated bandwidth of all of them.
Ok, so it's the aggregated bandwidth, perfect.
jdalrymple wrote: If the device(s) submitting flow data are routers it will be the aggregated data of all the traffic you define as "interesting" on those routers.
Added one of my routers to it with 4 interfaces and it and is capturing the data.
We do not have to - just please don't reply unless you have a valid question. We love positive feedback like this:
Anton @ CPB wrote:It does, thanks, just wanted to confirm
however in order to keep forum threads off of our company "todo list" the thread has to meet either the criteria of being locked or one of us (names in green) having been the last respondent.
I'll go ahead and leave it open, please only reply if you have a new question to ask though. Don't even respond just to say "OK I Understand thank you".
If you don't respond we'll assume you understand, and if you do respond we'll assume you don't understand and we'll lock it
......thanks