System Flow Table
The System Flow Table displays the flows from an entire network aggregated by flow technology. To open the table, click on the Table button the toolbar on the Flow tab. If you select a specific flow technology type during a System Refresh, then only the corresponding technology type tab will be populated.
For Basic Flow, the flow records are merged based off Source IP, Destination IP, Source Port, Destination Port, and DSCP and sorted by byte count and then the top 200 flows per device are displayed for the given time range. A non-zero value in the Sampler ID column denotes flows that are sampled.
For Medianet, the flows are merged based off Source IP, Destination IP, Source Port, Destination Port, DSCP , and RTP SSRC and sorted by byte count and then the top 200 per device are displayed for the given time range per device. Packet Loss %, Interarrival Jitter Mean, and Lost Event Count values are the max of all the records that were merged based off the tuples.
For AVC and NSEL, the last 200 records per device are shown for the given time frame.
The Unknown flow technology type is a flow type that doesn’t match any of the other flow types: Application (AVC), Basic Flow, Medianet, NSEL or PfR.
Flows generating an alert are highlighted in light red; the specific attribute exceeding an alert limit is highlighted in dark red. The alerts must be enabled for the particular flow technology for this to be visible.
NOTE: If a given flow with the same source and destination IP addresses are exported from the device using a different technology type, then the same flow would be represented in each flow technology type tab. The corresponding flow in the system topology view will only be shown once. The App Name field in the System Flow Table combines Application and NBAR Application data. When both are present, NBAR Application takes precedence. App Names followed by a (number:number) designate NBAR applications.
Right click on either the source or destination IP address in the System Flow Table and LiveNX provides additional options:
• Show Flow or Medianet Flow Path Analysis – displays an end-to-end analysis of the flow on a per-hop basis in the Basic Flow tab. Displays and end-to-end analysis of the Medianet flow on a per-hop basis in the Medianet flow tab.
• Define Custom Application Based on Flow – allows you to label a flow with a custom name and description.
• Add to IP Blacklist – highlights identification of IP addresses by turning it red in the topology device, flow table, and historical views. Please see Tools for Additional Information On the IP Blacklist Feature.
• Add to IP Mapping – allows mapping of IP addresses to a user-defined label. Please see Tools for Additional Information On the IP Mapping Feature.
• Copy to Clipboard – creates a one-click method to copy the IP address. • Export Flow Data – creates a .csv file of the system flow table.
Right click on any item in the System Flow Tab other than an item in either the Src IP, or the Dst IP to show flow path analysis, to define custom application based on flow, or to export the System Flow Table to a .csv file.