FlowFalcon Reports

Sources

The Sources section enables you to select the interfaces, device groups/device types, or object groups from which to present a FlowFalcon report. You cannot select a redundant source.

1. Click the Source Type drop-down.

   • Select Interfaces to create a report for flow data from the interfaces you allow on the Flow Interface Manager.

     1. Click the Device drop-down and select a device. Select All Devices to define the report to contain all devices.

     2. Click the Interface drop-down and select an interface. Select All Interfaces to define the report to contain all interfaces on the device you select.

     3. Click the Direction drop-down and select whether to define the report to display the Incoming, Outgoing, or All Directions traffic.

   • Select Device Groups, then click the Device Group drop-down and select a device group/device type. Select All Device Groups to create a report for flow data from all device groups/device types.

   • Select Object Groups, then click the Object Group drop-down and select an object group.

2. Click Add Source to add the device, interface, and direction to the Sources to Graph list.

3. Repeat to add additional sources.

Report Settings

The Report Settings section enables you to select the view and to define the report settings for the report. FlowFalcon views enable you to define the flow template fields to display in the report. SevOne NMS provides starter set FlowFalcon views to enable you to create common FlowFalcon reports

1. Click the Metric drop-down. This field appears when you select the Advanced FlowFalcon Views check box on the Cluster Manager Cluster Settings tab.

   • Select Bandwidth to populate the Report View drop-down list with views that focus the report on the volume of traffic.

   • Select Medianet to populate the Report View drop-down list with views that focus the report on Cisco Medianet video statistics.

   • Select Response Time to populate the Report Views drop-down list with views that focus the report on the delays caused by various parts of the network. To use the Response Time metric views, select the Monitor NAM Data check box on the Edit Device page and configure the NAM settings to enable the Cisco NAM device to send response time data to FlowFalcon reports.

2. Click the Mode drop-down.

   • Select Aggregated to populate the Report View drop-down list with views that use aggregated flow data which stores the most relevant flow data for faster report creation.

   • Select Granular to populate the Report View drop-down list with views that use raw flow data to allow for more specificity in the result set at the tradeoff of longer report execution times and less historical data availability.

3. Click the Report View drop-down and select a view. The list of views is dependent on the selections you make from the Metrics drop-down and from the Mode drop-down. See the FlowFalcon Views topic to view the list of FlowFalcon views. If you do not see an applicable view, the Report View field caption provides access to the FlowFalcon View Editor where you can create custom views.

4. Click the Time Span drop-down and select a time span. Select Custom to display the Choose a Time Range pop-up that enables you to define a custom time span.

5. Click the Time Zone drop-down and select a time zone.

6. Click the Split Sources drop-down.

   • Select Nothing to combine all results from the same direction across the same interface to allow for greater detail in the result set.

   • Select Interfaces to separate flow data into individual interfaces.

   • Select Groups to separate flow data by device group/device type or object group depending on the source you select. This option appears when you select Device Groups or Object Groups in the Source section.

7. Click the Network Segment drop-down and select a network segment. This enables you to resolve IP addresses into segments and to roll up results from the same segment into a single result. The Network Segment field caption link provides to access the Network Segment Manager where you manage network segments.

8. Click the Show Remaining Traffic drop-down.

   • Select Yes to display flow data for the top <n> results individually in the pie chart and the stacked line graph plus a Remaining Traffic graph item that groups the flow for the remaining flow sources that meet your filter criteria. You define <n> results in the next step.

   • Select No to display only the top <n> results in the pie chart and the stacked line graph. Remaining Traffic continues to display in the table.

9. In the Results to Display field, enter the number of individual results to display in the report. The display includes the first 200 results to optimize browser performance. Export the report to a .csv format or to a .pdf format to view the full result set of more than 200 results. Filters enable you to narrow the scope of the request (see the Filters section below). You can also modify the Selected Sources list to limit the number of sources in the report (see the Sources section above).

Advanced Report Settings

FlowFalcon reports display a table of flow data that can include a variety of information that describe the flows. The Advanced Report Settings section enables you to select the data columns to include in the FlowFalcon report table.

1. Click Advanced Report Settings to display the advanced report settings controls.

2. In the Data Columns field, select the check box for each data column to include in the report table. You must select the check box for at least one data column. All columns are described at the end of this chapter.

3. Click the Sort Column drop-down and select the data column on which to sort the table in the FlowFalcon report. This drop-down list displays the data columns you select in the previous step. The data column you select in this step determines the data to display in the pie chart and the stacked line graph in the FlowFalcon report.

4. Click the Sort Order drop-down and select to sort data in either Ascending or Descending order.

Resolution Settings

The Resolution Settings section enables you to define domain name resolution settings.

1. Click Resolution Settings to display the resolution settings controls.

2. Click the DNS drop-down.

   • Select Display IP to display raw IP addresses.

   • Select Display DNS to display resolved domain names when possible.

   • Select Display Both to display both IP addresses and resolved domain names.

3. Click the Protocols drop-down.

   • Select Display Number to display raw protocol numbers.

   • Select Display Name to display resolved protocol names.

   • Select Display Both to display both numbers and resolved names.

4. Click the Ports drop-down.

   • Select Display Number to display raw port numbers.

   • Select Display Name to display resolved port names.

   • Select Show Both to display both numbers and resolved names.

5. Click the DSCP drop-down.

   • Select Display Number to display DSCP port numbers.

   • Select Display Name to display DSCP port names.

   • Select Display Both to display both numbers and resolved names.

6. Click the AS drop-down.

   • Select Display Number to display AS port numbers.

   • Select Display Name to display AS port names.

   • Select Display Both to display both numbers and resolved names.

Display Settings

The Display Settings section enables you to define display settings.

1. Click Display Settings to display the display settings controls.

2. Click the Granularity drop-down and select the interval between data points in the results. SevOne NMS is optimized to receive flows every one minute. If you configure the router to send flows at a different interval, this setting enables you to view the report at the granularity that matches the router flow timeout setting. A router flow cache setting other than one minute is not recommended.

   • Select Auto to use the highest applicable granularity for the best display and fastest load time based on the time span you select.

   • Select a predefined interval.

   • Select Custom to enter a custom granularity. There is no limit to this value, but if the granularity is too small for the time span, SevOne NMS adjusts the granularity.

3. Click the Data Units drop-down and select Bits for network oriented data or select Bytes for server oriented data.

4. Click the Display as Rates drop-down and select Yes to display the results as bits or bytes per second or select No to display the total number of either bits or bytes.

Filters

The Filters section enables you to limit the results that appear in the report. Each filter contains one or more rules. Each filter rule applies to a specific flow field. Filter rules for a field not in the view are ignored. This enables you to define filters independently from views.

When you apply a filter to a FlowFalcon report that uses an aggregated view, the Other Traffic and Total Traffic numbers may appear inaccurate due to how the data is aggregated and stored in pre-calculated buckets. If you do not receive the expected number of results after you apply a filter to an aggregated view, increase the number of aggregated results to store for each write interval on the Cluster Manager Cluster Settings tab (FlowFalcon Aggregation TopN).

To delete a filter, click the Filter drop-down and select the filter to delete. The rules list displays the rules for the filter you select. Click Delete Filter to delete the filter.

Get Report Results

You can get a FlowFalcon report using the default FlowFalcon Reports page settings in two clicks. To get specific FlowFalcon report results, you can either perform the steps in the Define FlowFalcon Reports section before you run the report or you can run the report and then drill down to the specific information.

1. At the top of the FlowFalcon Reports page, the Sources section displays All Devices, All Interfaces, and All Directions. Click Add Source to add all devices, all interfaces, and all directions to the Sources to Graph list.

2. Below the Filters section on the FlowFalcon Reports page, click Get Results.

Detach FlowFalcon Reports

The following icons appear in the FlowFalcon Reports page title bar to enable you to export FlowFalcon reports.

- Click to export the summary data from the table to a .csv format.

- Click to export all granular data points in the graph to a .csv format.

- Click to export the report to a .pdf format.

- Click to add the FlowFalcon report as an attachment in a report on a new browser tab. You can modify reports to add other attachments and you can save reports to the Report Manager. Report workflows enable you to designate reports to be your favorite reports and to define one report to appear as your custom dashboard.

Navigate FlowFalcon Reports

FlowFalcon reports enable you to adjust the settings for the current graph then Graph Again. FlowFalcon reports enable you to Drill Down to get more specific information about the results without having to revise the report settings.

You can perform these steps in any sequence for any FlowFalcon report to display specific data.

• Click the Refresh Rate drop-down and select a refresh rate to update the report data at the frequency you select. You should not set the refresh rate to less than the write interval. The default write interval writes flow data to the disk every 60 seconds. The Cluster Manager Cluster Settings tab enables you to adjust the write interval.

• Click the View drop-down below the Get Results button and select a view from a list of views that share a field with the view you used to create the report. The list includes both more specific (drill down) views and less specific (fan out) views.

  Example: When the Top Talkers is the view that appears in the Report Settings section on the FlowFalcon Reports page, the views in the View drop-down list that appears in the report section share a field with the Top Talkers view.

• In the report table, click to manage the selection of the items in the table.

• Click Get Results to create a new report after you change the settings in the areas above the Get Results button.

  • Make changes in the Interfaces, Report Settings, Advanced Report Settings, Resolution Settings, Display Settings, and Filters sections.

  • Click Get Results.

• Click Drill Down to create a new FlowFalcon report with a new view and the same settings you define previously from the Interfaces, Advanced Report Settings, Resolution Settings, and Display Settings sections.

  • Click the View drop-down below the Get Results button and select a view from a list of views that share a field with the current report's view.

  • Select the check box for each item in the table to include in the new report to drill down for a specific source device.

  • Click Drill Down.

    Example: When you click Drill Down, the Report View field in the Report Settings section updates and the filters that appear in the Filters section update to reflect the filters associated with the new view. This enables you to view the filter criteria for the report and to modify the report to include (or exclude) additional filters. In the report table, click the Action icon and select Select None to clear the check boxes for all rows. Select the check box for only one row and click Drill Down. The report uses the settings you define above and now displays a report for the new view that contains the one item you select.

• Click Graph Again to use all of the settings from above to create a new graph for the data in the rows you select in the report table.

  • In the FlowFalcon report table, click the Action icon and select Select None to clear the check boxes for all rows in the table.

  • Select the check box for one row in the table.

  • Click Graph Again.

• Click within the FlowFalcon report table to display a line graph for that data item. The results for the Top Talkers view using the default FlowFalcon settings displays a table that contains the Source IP, Bandwidth, and Packets.

• • Click on an item in the Bandwidth column.

  • A line graph of the bandwidth for the source appears.

Remaining Traffic, Total Traffic, and FlowFalcon Flow Calculation

The bottom rows of the FlowFalcon report table contain rows for Remaining Traffic and Total Traffic.

• The Remaining Traffic row displays the total of all interfaces that are not part of the top <n> results (where <n> is the number you enter in the Results field in the Report Settings section above). If there are fewer results than the number you enter in the Report Settings section, the Remaining Traffic row does not appear.

• The Total Traffic row displays the total of all interfaces in the report, regardless of whether the source appear listed individually in the list or not.

The Graph Other setting in the Report Settings section enables you to include the remaining and total traffic in the pie chart and stacked line graph. Click the Graph Other drop-down and select Yes to display a gray slice in the pie graph and a gray line in the stacked line chart that represents the remaining traffic.

FlowFalcon reports depict the total rate of flows for each device/interface/direction after duplicating flows that lack directional information. NetFlow v5 only exports information about the incoming interface so SevOne NMS duplicates the flow statistics for v5 NetFlow to enable you to run reports for outgoing flows on devices that use v5 NetFlow. If your network only uses v5 NetFlow, the FlowFalcon report flow rate should be double the actual rate of flows that arrive at the collector. The flow rate in FlowFalcon reports is different from the flow rate that displays on the Flow Interface Manager that uses a different calculation for flow data.