Traffic Analysis Dashboard

Select Observation Source, Time/Date Ranges, and Filters

Use Built-in Views or Create Custom Views

The Traffic Analysis dashboard provides three operational views, each with its own suite of reports, charting, graphing along with endpoint, application, and keyword filtering rule sets. Advanced filtering, time range, and grouping by IP address, location and more make NTA a very powerful decision support, forensic, and root cause analysis solution.

• Home. Top n traffic, connections, and bandwidth utilization reports at a glance.
• Senders and Receivers. Top n interfaces ranked by incoming and outgoing traffic, geo location, and Internet domain.
• Troubleshooting. Top concurrent connections received/initiated, half-open or failed connections received/initiated, and traffic hitting non-standard ports.

Note: You can add custom views with the Add View control () and custom and built-in reports using the Add Reports palette.

Reports

All the reports that can be included in this dashboard are initially column-sorted by traffic totals in bytes (default). You can select the field to sort on in Report Settings .

You can sort reports with respect to traffic totals by either of the following:

• Bytes. (Default) Total bytes sent or received. (Sorting by bytes provides a picture of sheer volume and payload.)
• Packets. Packets sent or received. (Sorting by packets can provide a view of most active channels.)
• Flows. Generated flow summaries. (Sorting by flows can be thought of as sorting by connections.)

When changing the chart, reports automatically change the variable used for the units. When you adjust the 'sort by' column attribute, the rows sort in descending order according to the data values found in the sort by column. For example, the following table sorts by packets. ("Megapackets" is shown in the report included below.)

Top Applications Report with Packets Selected as the Sort by Field and Rate Shown in Kilopackets per Second

NTA Report Graphs: Collecting the Right Level of Report Detail

If you display NTA report data using a line graph, the level of detail revealed by the graph depends on how much raw or hourly data is retained according to NTA Settings. This characteristic applies to line graph reports that reveal either Flow, QoS, Interface or NBAR traffic data.

When you choose time constraints () for a graphed NTA report, the granularity of time-interval detail revealed in the graph is determined by factors listed in the following table: