Reporting

NetFlow Auditor Manual

Reporting

Traffic Analysis Reports

Netflow Auditor enables the user to perform live and historical analysis of netflow traffic, according to the level and type of network data they require. Traffic analysis works by means of querying the aggregated network traffic data collected by Netflow Auditor. The user may view the network data from various perspectives in the form of Traffic Analysis Reports.

The Traffic Analysis Report is displayed in the Display section of Netflow Auditor's main screen.

There are two representations of the traffic analysis output:

A graphic representation that uses various chart styles.
A tabular textual representation that contains exact figures.

Historic Reports and Template Reports

Reports are split into Historic and Template Reports:

Historic Report - A report, for a specific time frame, that is generated once and saved for historic purposes, and is available for future reference.
Template Report - A report based on specific parameters, which may be generated many times over, each time for a different time frame. A Template Report may be fine-tuned each time to fit your needs.

Types of Reports

Reports can be categorised into the following types:

Device Group Reports
Device Reports
Interface Reports
Account Reports
Cost Centre Reports
IP Address Reports
AS Reports
Protocol Reports
Port Reports
Qos Reports
Baseline Reports
Custom Reports

Device Group Reports

^Top

A Device Group Report is a traffic analysis report for Device Groups. A Device Group is a means by which to group devices together, so that a report may be produced displaying the summing up of several devices. When defining a Device it is associated with a Device Group.

See: Device Groups

A Device Group Report displays a summing up of all traffic for a given Device Group within a set time frame.

Report Screen Device Group

Generating a Device Group Report

You can generate two different Device Group Reports:

A monthly Device Group Report
An hourly Device Group Report

Monthly Device Group Reports

A monthly Device Group Report displays a summing up of all traffic for a given Device Group for every day within a month.

To generate a Monthly Device Group Report:

In the Navigation Pane, expand the Long-Term menu.
Select Long-Term > Devices > Device Group . The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Hourly Device Group Reports

An Hourly Device Group Report displays a summing up of all traffic for a given Device Group for every minute within an hour.

To generate a Hourly Device Group Report:

In the Navigation Pane, expand the Real-Time menu.
Select Real-Time > Devices > Device Group . The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Device Reports

^Top

A Device relates to a specific IP address, usually but not necessarily, to one specific machine. In this way, a report may be produced for a specific user on the Network.

See: Devices

A Device Report displays a summing up of all traffic for a given Device within a set time frame.

Report Screen Device

Generating a Device Report

You can generate two different Device Reports:

A monthly Device Report
An hourly Device Report

Monthly Device Reports

A monthly Device Report displays a summing up of all traffic for a given Device for every day within a month.

To generate a Monthly Device Report:

In the Navigation Pane, expand the Long-Term menu.
Select Long-Term > Devices > Device . The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Hourly Device Reports

An Hourly Device Report displays a summing up of all traffic for a given Device for every minute within an hour.

To generate a Hourly Device Report:

In the Navigation Pane, expand the Real-Time menu.
Select Real-Time > Devices > Device . The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Interface Reports

^Top

An Interface Report is a traffic analysis report for Interfaces. An Interface is a means by which to define several different entities within the same Device. For example, on the same machine, you may have several web servers running, each using a different protocol. You will want to monitor each of these separately.

See: Interfaces

A Interface Report displays a summing up of all traffic for a given Interface within a set time frame.

Report Screen Interface

Generating an Interface Report

You can generate two different Interface Reports:

A monthly Interface Report
An hourly Interface Report

Monthly Interface Reports

A monthly Interface Report displays a summing up of all traffic for a given Interface for every day within a month.

To generate a Monthly Interface Report:

In the Navigation Pane, expand the Long-Term menu.
Select Long-Term > Devices > Interface > Source/Destination. The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Hourly Interface Reports

An Hourly Interface Report displays a summing up of all traffic for all Interfaces for every minute within an hour.

To generate a Hourly Interface Report:

In the Navigation Pane, expand the Real-Time menu.
Select Real-Time > Devices > Interface > Source/Destination. The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Account Reports

^Top

An Account Report is a traffic analysis report for Accounts. Accounts are units which are used in defining segments of your network. An account will mark different segments of your network that are used for the same purpose, or in the same context. An Account, therefore, may be associated with more than one Network segment.

See: Accounts

A Account Report displays a summing up of all traffic for a given Account within a set time frame.

Report Screen Account

Generating an Account Report

You can generate two different Account Reports:

A monthly Account Report
An hourly Account Report

Monthly Account Reports

A monthly Account Report displays a summing up of all traffic for a given Account for every day within a month.

To generate a Monthly Account Report:

In the Navigation Pane, expand the Long-Term menu.
Select Long-Term > Business Groups > Account > Source/Destination. The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Hourly Account Reports

An Hourly Account Report displays a summing up of all traffic for all Accounts for every minute within an hour.

To generate a Hourly Account Report:

In the Navigation Pane, expand the Real-Time menu.
Select Real-Time > Business Groups > Account > Source/Destination. The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Cost Centre Reports

^Top

A Cost Centre Report is a traffic analysis report for Cost Centres. Cost Centres are units which are used in defining segments of your network. A Cost Centre will mark different segments of your network that are used for the same purpose, or in the same context. A Cost Centre, therefore, may be associated with more than one Network segment.

See: Cost Centres

A Cost Centre Report displays a summing up of all traffic for a given Cost Centre within a set time frame.

Report Screen Account

Generating an Cost Centre Report

You can generate two different Cost Centre Reports:

A monthly Cost Centre Report
An hourly Cost Centre Report

Monthly Cost Centre Reports

A monthly Cost Centre Report displays a summing up of all traffic for a given Cost Centre for every day within a month.

To generate a Monthly Cost Centre Report:

In the Navigation Pane, expand the Long-Term menu.
Select Long-Term > Business Groups > CostCentre > Source/Destination . The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Hourly Cost Centre Reports

An Hourly Cost Centre Report displays a summing up of all traffic all given Cost Centres for every minute within an hour.

To generate a Hourly Cost Centre Report:

In the Navigation Pane, expand the Real-Time menu.
Select Real-Time > Business Groups > CostCentre > Source/Destination. The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

IP Address Reports

^Top

An IP Address Report is a traffic analysis report for IP Address'.

An IP Address Report displays a summing up of all traffic for all IP Addresses in a specified range within a set time frame. These can be either Source IP Addresses or Destination IP Addresses.

Report Screen Account

Generating an IP Address Report

You can generate two different IP Address Reports:

A monthly IP Address Report
An hourly IP Address Report

Monthly IP Address Reports

A monthly IP Address Report displays a summing up of all traffic for a given IP Address for every day within a month.

To generate a Monthly IP Address Report:

In the Navigation Pane, expand the Long-Term menu.
Select Long-Term > Business Groups > IP Address > Source/Destination. The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Hourly IP Address Reports

An Hourly IP Address Report displays a summing up of all traffic for all IP Address' for every minute within an hour.

To generate a Hourly IP Address Report:

In the Navigation Pane, expand the Real-Time menu.
Select Real-Time > Business Groups > IP Address > Source/Destination. The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

AS Reports

^Top

An AS Report is a traffic analysis report for AS Numbers. An AS Number is a unique identifier for a collection of IP networks and routers under the control of one entity.

See: AS Numbers

An AS Report displays a summing up of all traffic for a given AS Numbers within a set time frame.

Report Screen AS

Generating an AS Report

You can generate two different AS Reports:

A monthly AS Report
An hourly AS Report

Monthly AS Reports

A monthly AS Report displays a summing up of all traffic for a given AS Numbers for every day within a month.

To generate a Monthly AS Report:

In the Navigation Pane, expand the Long-Term menu.
Select Long-Term > Business Groups > AS > Source/Destination. The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Hourly AS Reports

An Hourly AS Report displays a summing up of all traffic for all AS Numbers for every minute within an hour.

To generate a Hourly AS Report:

In the Navigation Pane, expand the Real-Time menu.
Select Real-Time > Business Groups > AS > Source/Destination. The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Protocol Reports

^Top

A Protocol Report is a traffic analysis report for Protocols. A Protocol is a set of rules governing communication between devices.

See: Protocols

A Protocol Report displays a summing up of all traffic for a given Protocol Numbers within a set time frame.

Report Screen Protocol

Generating an Protocol Report

You can generate two different Protocol Reports:

A monthly Protocol Report
An hourly Protocol Report

Monthly Protocol Reports

A monthly Protocol Report displays a summing up of all traffic for all Protocols for every day within a month.

To generate a Monthly Protocol Report:

In the Navigation Pane, expand the Long-Term menu.
Select Long-Term > Applications > Protocol. The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Hourly Protocol Reports

An Hourly Protocol Report displays a summing up of all traffic for all Protocol for every minute within an hour.

To generate a Hourly Protocol Report:

In the Navigation Pane, expand the Real-Time menu.
Select Real-Time > Applications > Protocol. The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Port Reports

^Top

A Port Report is a traffic analysis report for Ports. A port is a virtual data connection that can be used by Devices to exchange data directly.

See: Ports

A Port Report displays a summing up of all traffic for all Ports within a set time frame.

Report Screen Port

Generating an Port Report

You can generate two different Port Reports:

A monthly Port Report
An hourly Port Report

Monthly Port Reports

A monthly Port Report displays a summing up of all traffic for defined Ports for every day within a month.

To generate a Monthly Port Report:

In the Navigation Pane, expand the Long-Term menu.
Select Long-Term > Applications > Port. The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Hourly Port Reports

An Hourly Port Report displays a summing up of all traffic for all Ports for every minute within an hour.

To generate a Hourly Port Report:

In the Navigation Pane, expand the Real-Time menu.
Select Real-Time > Applications > Port. The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

QoS Reports

^Top

A QoS Report is a traffic analysis report for QoS Levels. Quality of Service (QoS) refers to the probability of a packet succeeding in passing between two points in the network within its desired latency period. This creates a standard, by which the highest level of QoS is defined as �Best Effort� and this is succeeded by lower levels, in which each packet has to wait longer for the router to attend to it. Netflow Auditor enables you to analyze network traffic in relation to different QoS Levels

See: QoS

A QoS Report displays a summing up of all traffic for a given QoS Values within a set time frame.

Report Screen QoS

Generating an QoS Report

You can generate two different QoS Reports:

A monthly QoS Report
An hourly QoS Report

Monthly QoS Reports

A monthly QoS Report displays a summing up of all traffic for a given QoS Values for every day within a month.

To generate a Monthly QoS Report:

In the Navigation Pane, expand the Long-Term menu.
Select Long-Term > Applications > QoS. The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Hourly QoS Reports

An Hourly QoS Report displays a summing up of all traffic for all QoS Numbers for every minute within an hour.

To generate a Hourly QoS Report:

In the Navigation Pane, expand the Real-Time menu.
Select Real-Time > Applications > QoS > Selected/Lower/Source/Destination. The report is displayed appears in the display section.
At this stage, you can choose a different type of graphic display or fine-tune the report.

See: Filtering a Report

Baseline Reports

^Top

Report Screen Baseline NM

Custom Reports

^Top

Filtering a Report

^Top

After a report is produced, you may want to fine-tune it to fit your needs. For example, you can change the granularity of the report.

To fine-tune a report:

Generate your report. For example, a monthly Protocol Report.
Click the Filter button.
The Filter Screen is displayed in the Display Section.

The filter screen is populated with the previous report�s data filtering criteria.
Change any of the properties as you see fit.
Click Generate Report.
Zoom into a Report
^Top

The zooming functionality is available for the Netflow Auditor charting applet. Users can zoom into all bar, line and area charts.

You can zoom into a report to reveal more intricate details.

To zoom down into a report:
Generate a report.
Following is an example of a weekly baseline report.
Drag the mouse to select an area within the graph into which you wish to drill down.

A new graph is displayed elaborating only the selected area with greater detail.
Repeat Step 2, as many times as you want.
Drill-Down into a Report
^Top

The drill-down functionality of Netflow Auditor gives the user single point analysis of traffic from the charting applet. All charts can be analyzed through the drill-down menu by using the right-click button of the mouse.

To drill-down into a chart:
For line charts focus on a single point by clicking on a single point locater. For bar, area and pie charts skip to step 2. For charts with a lot of detail zoom in for more accurate drill-down analysis. See Custom Reports Zoom.
Right-click on the focus point/area to access the advanced template drill down menu.
Left-click on the focus point/area to access the basic template drill down menu.
Select from the drill-down menu to analyze Devices/Business Groups/Applications/Time.
Continue to drill-down on single points to further analyze traffic.
drill-down menus:

Saving a Report
^Top

Saving reports is a very important process, not only for creating historical reports, but also for scheduling automated report production and delivery.

To save a report:
Produce your report.
Click Save.
The Report Destination Screen appears in the Display Section.

The Report Destination Screen appears in the Display Section.
Enter a Title for the report.
Select a Type and Category for the report.
Select a reporting period.
(Optional) Enter a description for the report.
Click Save New.