Active Devices

The Monitoring Center allows you to display a list of devices that communicate on the network at some point in time. By default, this service is turned on. It can be turned off in the Flowmon Configuration Center (FMC Configuration in Active Devices > Basic settings).

On the Active Devices page, you can see a search form, Overview tab, and List tab. The Overview tab displays tables with interesting information about the monitored network, such as Top vendors, Active devices in time, and so on. The List tab contains a table listing devices that communicated on the network in the defined interval. If there are more than 100 entries, the table is divided into more pages.

Search Form

At the top of the page, there is a search form, where you can enter values to restrict the output. The meaning of each attribute is described below. Some attributes are only available for the List tab.

Interval - set the interval of displayed data. Either select one of the preset segments or type the desired date and time in the From and To fields.

Identify device by - this field allows you to change the identification key of the active device. This choice can be applied to the search query only. Global settings of the device identification can be set in Configuration Center → FMC Configuration → Active devices.

IP address, subnet or hostname - field for search by IP address, subnet, or hostname. It supports both IPv4 and IPv6. To display all IPv4 addresses insert string 0.0.0.0/0, for all IPv6 addresses 0::/0.

MAC address - field for search by MAC address.

User ID - this option filters devices where a user with the provided ID was logged in. For this feature, the collector must process syslog messages from identity services like DHCP servers, VPN, directory services, and so on.

VLAN - search can be limited by the VLAN value. It displays only the devices that communicated in the virtual network.

Sources - select relevant flow sources.

Host OS - the third line allows you to choose one of the operating systems that can be detected by Flowmon Probe for all HTTP client devices. For this feature, flow data must be exported by Flowmon Probe.

The following options are only available for the List tab.

Limit to - limits the number of results that are displayed. For faster response time, we recommend reducing this value to the required limit. If some rows are merged, the total row number is lower. See the attribute below.

Merge flows with gap - the database stores flows in the way they are closed at the end of the hour, that is, one flow is displayed on multiple lines if its start and end time are in different hours. To merge these flows, you must check this box. The related input sets the maximum time gap between flows that you want to join. It is set to 15 minutes by default, meaning that any two flows where the Source & Destination IP and Source & Destination MAC addresses are the same and a time gap between their Start and End times is less than 15 minutes will be merged together. If some flows are merged, the number of records in the table is lower than the value of Limit to.

Aggregate - if you want an overall view of communication in the network, you can use this setting to merge records that have common characteristics. If you check the IP address value, records with the same listening port, VLAN, and IP address will merge into one. If you check the MAC address value, records that have the same listening port, VLAN, and MAC address will merge into one. The same applies to Host OS and User ID. In the First seen column, time is displayed since when the device was active. In the Last seen column is the time until when the device was active.

Show routers - MAC addresses of routers are set in the Configuration Center > FMC Configuration > Active Devices / Routers . These devices change the MAC addresses in the packets, thus these MAC addresses are assigned to many different IP addresses. To show results as clearly as possible, router records are not shown in the table. If you wish to see them, check this field.

View button - Click this button to perform the query according to configured parameters. The result is listed in the results table.

Export to CSV button - save the search result to a CSV file. It executes the query and after a while, it prompts you to download the generated file.

Export to PDF button - executes the query and generates the PDF file for download.

Overview Tab

After entering the search criteria and clicking View under the form, the widgets are shown. In the widgets, various useful information is displayed. The widgets can be used in the Flowmon Dashboards and Reports module as well.

List Tab

After entering the search criteria and clicking View under the form, the table with the results is shown. The number of table columns may vary based on the selected aggregations. The First seen column shows the date and time when the device started to communicate. The Last seen column shows the time when the communication was stopped. The IP address column shows the IP address of the device at that time. The MAC address column displays the MAC address of the device and manufacturer if the user has activated the Resolve domain names function. The Host OS and User ID columns display more information, if available. The last two columns (VLAN and Flow source) display information about where the communication was intercepted.

If you right-click on IP or MAC address field, a context menu appears where you can rename these items or restrict the search by this value. At the MAC address field, there is also a menu item Add to a list of routers, which stores the value in the routers table, that is not displayed in the results by default. If you have routers displayed and the device is stored in the router table, the item Remove from router list is displayed in the menu.

The footer of the table shows the summary of the total number of records displayed, the number of unique MAC addresses, IPv4 addresses, and IPv6 addresses.