Report templates, Address reports, Session reports – Fluke Computer Accessories User Manual
Page 28: Appendix 1
User’s Guide – version 3.5
NetFlow Tracker
28
Report Templates
Whenever you create a new tabular report or chart you can choose any of the
standard report templates depending on what you want to examine:
Address Reports
•
Source Addresses – shows the IP addresses that were the source of most traffic
or packets.
•
Destination Addresses – shows the destination IP addresses that were the
destination of most traffic or packets.
•
Addresses – shows the IP addresses that were the source or destination of the
most traffic or packets.
•
Address Pairs – shows the pairs of connected IP addresses that exchanged most
traffic or packets.
•
Bi-directional Address Pairs – adds extra columns showing the traffic and packets
sent from destination to source and the bi-directional totals for each address pair.
•
Source Address Dissemination – shows the source addresses that conversed with
the most distinct destination addresses and that were involved in the most distinct
endpoint-to-endpoint conversations. This can help detect file sharing or virus
infected hosts.
•
Destination Address Popularity – shows the destination addresses that conversed
with the most distinct source addresses and that were involved in the most
distinct conversations.
Session Reports
•
Protocols – shows the IP protocols, such as TCP or UDP, used by most traffic or
packets.
•
Source Applications – shows the IP applications that were the source of most
traffic or packets. An IP application is a combination of a set of IP addresses,
application ports and protocols; common examples are HTTP or FTP. You can
assign names to applications using the
settings page.
Examining the source applications inwards on an interface can show you what
applications are using your Internet bandwidth.
•
Destination Applications – shows the IP applications that were the destination of
most traffic or packets. The destination applications outwards can show the most
requested applications on a link.
•
Recognised Applications – shows the IP applications that were the source or
destination of most traffic or packets. Whether the application was the source or
destination depends on whether it has a name defined in the
settings page, or if neither have names, whichever has the lower port number.
•
Conversations – shows the pairs of connected endpoints that exchanged most
traffic or packets. A single conversation represents, for example, a web browser
downloading a single image. Note that a conversation has exactly one source and
destination address and application port – grouped applications are not used.