Fluke Computer Accessories manual Report Templates, Address Reports, Session Reports

User’s Guide – version 3.5 NetFlow Tracker

Report Templates

Whenever you create a new tabular report or chart you can choose any of the standard report templates depending on what you want to examine:

Address Reports

•Source Addresses – shows the IP addresses that were the source of most traffic or packets.

•Destination Addresses – shows the destination IP addresses that were the destination of most traffic or packets.

•Addresses – shows the IP addresses that were the source or destination of the most traffic or packets.

•Address Pairs – shows the pairs of connected IP addresses that exchanged most traffic or packets.

•Bi-directional Address Pairs – adds extra columns showing the traffic and packets sent from destination to source and the bi-directional totals for each address pair.

•Source Address Dissemination – shows the source addresses that conversed with the most distinct destination addresses and that were involved in the most distinct endpoint-to-endpoint conversations. This can help detect file sharing or virus infected hosts.

•Destination Address Popularity – shows the destination addresses that conversed with the most distinct source addresses and that were involved in the most distinct conversations.

Session Reports

•Protocols – shows the IP protocols, such as TCP or UDP, used by most traffic or packets.

•Source Applications – shows the IP applications that were the source of most traffic or packets. An IP application is a combination of a set of IP addresses, application ports and protocols; common examples are HTTP or FTP. You can assign names to applications using the IP Application Names settings page.

Examining the source applications inwards on an interface can show you what applications are using your Internet bandwidth.

•Destination Applications – shows the IP applications that were the destination of most traffic or packets. The destination applications outwards can show the most requested applications on a link.

•Recognised Applications – shows the IP applications that were the source or destination of most traffic or packets. Whether the application was the source or destination depends on whether it has a name defined in the IP Application Names settings page, or if neither have names, whichever has the lower port number.

•Conversations – shows the pairs of connected endpoints that exchanged most traffic or packets. A single conversation represents, for example, a web browser downloading a single image. Note that a conversation has exactly one source and destination address and application port – grouped applications are not used.

28