SevOne logo
You must be logged into the NMS to search.

Table of Contents (Start)

FlowFalcon View Editor

This documentation applies to NMS version 5.4. An online version of the software can be found here.

The FlowFalcon View Editor enables you to manage the FlowFalcon views you use to create FlowFalcon reports. FlowFalcon views use flow data fields from the flow templates to display reports of flow statistics. The Flow Template Status page displays a list of the devices you enable to send flow data to SevOne NMS and the flow template fields that the device sends.

To access the FlowFalcon View Editor from the navigation bar, click the Administration menu, select Flow Configuration, and then select FlowFalcon View Editor. The FlowFalcon Reports page also provides access to the FlowFalcon View Editor.

images/download/attachments/11509893/flowfalconvieweditor.png

There are two types of FlowFalcon views.

  • Aggregation Disabled views use the raw flow data to allow for more specificity in the result set at the tradeoff of longer report execution times and less historical data availability.

  • Aggregation Enabled views use aggregated flow data to present the most relevant flow data for faster report creation. Your SevOne appliance hardware determines the maximum number of aggregated views (between 5 and 20). The View drop-down list on the FlowFalcon View Editor displays aggregated views in blue font.

Create Custom FlowFalcon Views

SevOne NMS provides a starter set of FlowFalcon views to enable you to create FlowFalcon reports right out of the box and to help create FlowFalcon views that are specific to your network. Starter set views display an asterisk <*> in the View drop-down list.

If you select a view that has aggregation enabled, when you click Save, all aggregation data that exists for the view is deleted, even if you do not make any changes.

  1. Click the Metrics drop-down. This field appears when you select the Advanced FlowFalcon Views check box on the Cluster Manager Cluster Settings tab.

    • Select Bandwidth to create a view that focuses the report on the volume of traffic.

    • Select Medianet to create a view that focuses the report on Cisco Medianet video statistics.

    • Select Response Time to create a view that focuses the report on the delays caused by various parts of the network. To use the Response Time metric views, you must select the Monitor NAM Data check box on the Edit Device page and define the NAM settings so that a Cisco NAM device sends NAM response time data to the FlowFalcon Reports page.

  2. Click the View drop-down and select a view to customize or select New View to create a view from scratch. See the FlowFalcon Views chapter to view the list of starter set FlowFalcon views.

  3. Click the View Category drop-down.

    • Select an existing view category to include the view in the category you select.

    • Select New Category to create a new view category for the view. Enter the category name in the text field that appears.

  4. Click the Enable Aggregation drop-down.

    • Select Disabled to create a granular view that uses raw flow data. Whenever you select Disable, a message appears to warn you that any aggregation data associated with the view will be deleted. Click OK on the message but be aware that when you click Save, all aggregated data that is associated with the view is deleted.

    • Select Enabled to create an aggregated view that uses aggregated flow data. There is a limit to the number of aggregated views your appliance can support.

  5. In the New View Name field, enter the name of the view.

  6. The Flow Fields section enables you to select the flow template fields to include in the view. The flow template fields you move to the Fields in View field are included in the view (use Ctrl or Shift keys to multi-select). The fields display in the report in the sequence in which they appear in the Fields in View list.

  7. Click one of the following buttons.

    • When you edit a view, click Save to overwrite the original view with the changes you make. This deletes any existing aggregated data for an aggregated view.

    • Click Save as New to create a copy of the view. This preserves aggregated data for the original view when you edit an aggregated view. (The new aggregated view starts out with no aggregated data.)

    • When you edit a view, click Delete to delete the view and any associated aggregated data.

  8. Click FlowFalcon to return to the FlowFalcon Reports page.

SevOne NMS Flow Fields

SevOne NMS calculates and/or manipulated flow data to create the following fields. For fields 45050-45056, you need to understand MPLS well enough to know which MPLS attributes correspond to your network's VPN 2nd Top Layer ID, PE Egress Address, Customer VRF, Source IP Address, and Ingress PE Address. In SevOne NMS, there are three requirements to map MPLS attributes to flow data for FlowFalcon Reports.

  • On the Cluster Manager, Cluster Settings tab, FlowFalcon subtab, select the Enable MPLS Attribute Mapping check box and enter the MPLS Attribute Mapping Refresh Interval.

  • On the MPLS Flow Mapping page, upload two MPLS mapping files.

  • On the FlowFalcon View Editor, create views that include at least one field 45050-45056.

Field #

Field Name

Field Description

45000

Application Port

The SRC or DEST port, whichever is lower. This is the port of the application.

45001

Application IP

IPv6 address associated with the application.

45002

Client Port

Higher of SRC and DEST ports.

45003

Client IP

IPv6 address associated with the client.

45004

Application Direction

The direction of the traffic. 0 means Application Port == Source Port, 1 means Application Port == Destination Port.

45005

Next Hop IP

NetFlow view field 15 Next Hop IP is IPv4 specific and field 62 Next Hop IPv6 Address is IPv6 specific. SevOne NMS provides field 45005 Next Hop IP that pulls IPv4 from field 15 and IPv6 from field 62.

45006

Source IP Prefix

Routing prefix of the source IP address.

45007

Destination IP Prefix

Routing prefix of the destination IP address.

45010

Engine ID

First byte of the NBAR application tag (element ID 95).

45011

Application ID

3 low bytes of the NBAR application tag (element ID 95).

45020

ToS 3-bit

First three bits of the Type of Service byte.

45021

ToS 4-bit

First four bits of the Type of Service byte.

45040

Active Directory User

The result of a look up of the client IP address in the active_directory_ips table.

45041

Peer AS

The AS of the peer for the interface through which the flow transited.

45042

Peer AS Path

The BGP path ID is the identifier SevOne NMS assigns to a route as the collector receives path updates.

45050

Customer Client IP

Customer specific IP address of the connection origin in the context of MPLS.

45051

Customer Client Subnet

Customer specific IP subnet for the connection origin in the context of MPLS.

45052

Customer VRF Name

Name of the customer VRF looked up in the database that uses MPLS_lable_2 (element 71) and PE Egress address.

45053

Customer Application IP

Customer specific IP address for connection target in the context of MPLS

45054

Customer Application Subnet

Customer specific IP subnet for connection target in the context of MPLS

45055

PE Ingress IP

IP Address of Ingress Provider Edge Router.

45056

PE Egress IP

IP Address of Egress Provider Edge Router.