Flow Forensics Reports › Flow Forensics Report Types

Flow Forensics Report Types

The following topics describe the available Flow Forensics reports.

Address Report Group

Address Pairs Report

Displays the volume, rate, and percent of total inbound bytes/packets, as well as the flow count of each source and destination address pair.

Destination Address Peer Count Report

Displays the following information about each traffic destination:

• Destination address.
• Number of unique source addresses that exchanged traffic with the destination host.
• Flow count.

Destination Addresses Report

Displays the volume, rate, and percent of total inbound bytes/packets, as well as the flow count of each traffic destination.

Source Address Peer Count Report

Displays the following information about each traffic source:

• Source address.
• Number of destination addresses that received traffic from the source host.
• Flow count.

Source Address Peer Count with Destination Port Report

Displays the following information about each traffic source:

• Source address.
• Destination port.
• IP protocol.
• Number of destination addresses that received traffic from the source host.
• Flow count.

Source Addresses Report

Displays the volume, rate, and percent of total inbound bytes/packets, as well as the flow count of each source address.

ICMP Report Group

Bad IP Headers Report

Displays the source address and flow count of each bad IP header--each IP header that failed the checksum.

Fragmentation Required and DF Flag Set Report

Displays the following information about packets that require fragmentation--packets that had unreachable hosts or that were flagged Fragmentation Needed and Don't Fragment:

• Destination address.
• Number of source addresses that sent this type of data to the destination addresss.
• Number of flows that contained packets of this type.

ICMP Traffic Summary Report

Summarizes the Internet Control Message Protocol (ICMP) types and codes that occurred. The report contains the following information:

• ICMP description, type, and code.
• Volume of inbound packets for each ICMP.
• Flow count for each ICMP.

Ping Conversation Pairs Report

Displays the following information about ping requests:

• Source address.
• Destination address.
• Volume of inbound packets.
• Flow count.

Ping Destinations Report

Displays the following information about ping request destinations:

• Destination address that received the request.
• Volume of inbound packets.
• Flow count.

Ping Sources Report

Displays the following information about ping request sources:

• Source address that generated the request.
• Volume of inbound packets.
• Flow count.

Traceroute Requests by Destination Report

Displays the following information about traceroute request destinations:

• Destination address of the traceroute request.
• Number of source addresses that sent traceroute requests to the destination.
• Flow count.

Traceroute Requests by Source Report

Displays the following information about traceroute request sources:

• Source address of each traceroute request.
• Number of destination addresses that received traceroute requests from the source.
• Flow count.

Traceroute Requests Pairs Report

Displays the following information about each traceroute address pair:

• Source address of the traceroute request.
• Destination address of the traceroute request.
• Flow count.

TTL Expired in Transit Report

Displays the following information about data that met or exceeded the Time To Live (TTL) threshold:

• Source address.
• Destination address.
• Flow count.

Unreachable Destination by Source Report

Displays the following information about sources that tried to connect with unreachable destinations:

• Source address.
• Volume of inbound packets.
• Flow count.

Unreachable Destination Networks Report

Displays the following information about unreachable destinations:

• Destination network and subnet mask.
• Number of inbound packets.
• Flow count.

Unreachable Destinations Report

Displays the following information about sources and unreachable destinations:

• Source address.
• Destination network and subnet mask.
• Volume of inbound packets.
• Flow count.

MAC Report Group

Destination MAC Report

Displays the volume, rate, and percent of total inbound bytes/packets, as well as the flow count on each destination Media Access Control (MAC) address.

MAC Pairs Report

Displays the volume, rate, and percent of total inbound bytes/packets, as well as the flow count on each pair of source and destination MAC addresses.

Source MAC Report

Displays the volume, rate, and percent of total inbound bytes/packets, as well as the flow count on each source MAC address.

MPLS Reports

MPLS Labels Report

Displays the volume, rate, and percent of total inbound bytes/packets, as well as the flow count of traffic that had a unique combination of the following values:

• Router address.
• Multiprotocol Label Switching (MPLS) address.
• MPLS label type.
• MPLS top label.

Network Reports Group

Autonomous System Pairs Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of traffic between a pair of source and destination autonomous systems.

Autonomous System Pairs (with Destination Network) Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of traffic that had a unique combination of the following values:

• Source AS.
• Destination AS.
• Destination network and subnet mask.

Destination Autonomous Systems Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of traffic on each destination autonomous system.

Destination Networks Report

Displays the volume, rate, and percent of total inbound bytes/packets, as well as the flow count of traffic on each destination network and subnet.

Network Pairs Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of traffic on each pair of source and destination network subnets.

Network Pairs (with ToS) Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of traffic on each network pair that had a unique combination of the following values:

• Source network and subnet mask.
• Destination network and subnet mask.
• ToS.

Next Hops Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of traffic for each next-hop address.

Source Autonomous Systems Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of traffic on each source autonomous system.

Source Networks Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of traffic on each source network and subnet.

TCP Resets Report

Displays the TCP reset count of traffic on each source and destination address pair.

QOS Report Group

Differentiated Services Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the traffic flow count for each DiffServ code point (DSCP) value.

Types of Service Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the traffic flow count for each Type of Service (ToS).

Session Report Group

Client-Server Sessions

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of each session that had a unique combination of the following values:

• Source and destination address.
• Destination port.
• IP protocol.

Conversation Sessions Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count and cumulative flow duration of each conversation session that had a unique combination of the following values:

• Router address.
• Inbound interface.
• Source address and port.
• Destination address and port.
• ToS.
• IP protocol.

Conversations Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of traffic for each IPv4 address pair that had a unique combination of the following values:

• Source address and port.
• Destination address and port.
• IP protocol.

Conversations (IPv6) Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of traffic for each IPv6 address pair that had a unique combination of the following values:

• Source address and port.
• Destination address and port.
• IP protocol.

Conversations (with Interfaces)

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of each conversation that had a unique combination of the following values:

• Router address.
• Inbound and outbound interface.
• Source address and port.
• Destination address and port.
• IP protocol.

Destination Applications Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of traffic that had a unique combination of the following values:

• Destination port.
• IP protocol.

Destination Endpoints Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of traffic that had a unique combination of the following values:

• Destination address.
• Destination port.
• IP protocol.

Protocols Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of traffic that had a unique IP protocol.

Server-Client Sessions Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of each traffic session that had a unique combination of the following values:

• Source address and port.
• Destination address and port.
• IP protocol.

Source Applications Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of each traffic session that had a unique combination of the following values:

• Source port.
• IP protocol.

Source Endpoints Report

Displays the volume, rate, and percent of total inbound bytes and packets. Also displays the flow count of each traffic session that had a unique combination of the following values:

• Source address.
• Source port.
• IP protocol.

TCP Reports

TCP Flags Report

Displays volume, rate, and percent of total inbound bytes/packets, as well as the flow count of traffic for each TCP flag.

VLAN Report Group

Destination VLANs Report

Displays the volume, rate, and percent of total inbound bytes/packets, as well as the flow count of traffic on each destination VLAN.

Source VLANs Report

Displays the volume, rate, and percent of total inbound bytes/packets, as well as the flow count of traffic on each source VLAN.

VLAN Pairs Report

Displays the volume, rate, and percent of total bytes in/packets in, as well as the flow count of traffic on each source and destination VLAN pair.