Flows

The Reports » Tools panel includes Flows only if at least one Flow Sensor is configured. Within this tab, you can list, aggregate, filter, and sort flow records, generate traffic tops and statistics, and build interactive flow graphs.

35.1. Flow Records

In this sub-tab you can list and filter flow data.

● Sensor Interfaces – Select interfaces of interest. Guest accounts may have restricted visibility

● Flow Filtering Expression – Enter a filtering expression for flows. Click the star icon for syntax details. Common expressions can be saved/reused

● Export – The output can be shown in HTML, TEXT, JSON, or CSV, converted to PDF, emailed, or printed. If you need to query a very large volume of flows, avoid listing them all in the browser – the page may time out. In that case, choose CLI to see the shell command used for listing flows, then run that command from the shell and redirect the output to a file (the CLI option is not shown to guest accounts)

● Time Range – Select a predefined time range, or Custom… to specify an exact interval. Only flows that started or ended within the selected interval are shown. Time zone differences between the Console server and remote Flow Sensor servers are not adjusted automatically

● Limit – List only the first <number> flows, up to 50,000, and 200 by default. To list more, use the CLI export option

● Aggregation – Flows are not aggregated by default. The menu merges matching flows by any combination of Protocol, TCP Flag, Source Port and Destination Port, and by Source Subnet and Destination Subnet — each collapsing addresses either per whole IP or into IPv4/IPv6 blocks of the mask length set beside it. Bidirectional instead merges each flow with its reverse into one record, and while it is ticked the other options are disabled

● Sorting – The Sorting menu’s By Date item orders the listing by the flows’ start time; left off, flows are listed grouped in the order of the Sensor Interfaces

● Display – Compact, Extended or Full pick a progressively wider set of columns, each preset also flipping the Display Options to match; Custom… reveals a Custom Format field for your own nfdump-style format string

● Display Options – Configure how columns are shown: IP Addresses can be displayed as Numeric, Mixed, or Hostname, optionally with Show Country; Raw Values toggles unformatted ASNs, Dates, Ports, Protocols, and Units; Switch Bytes with Bits displays byte counters as bits. Check Include Unmonitored Ifs to add flows from interfaces not monitored by Flow Sensor but exported by the flow exporter; this also lifts the time-window restriction applied when reading flow data files

● Refresh – Press Generate to run the query, or select an automatic refresh interval

Note

The raw flow data is saved on disk in five-minute intervals, so a flow can take up to five minutes after being sent before it becomes queryable.

If no data is shown and the Flow Sensor is not running on the Console server, follow the NFS configuration steps.

35.2. Flow Tops

In this sub-tab you can generate tops from flow data.

● Sensor Interfaces – Select interfaces of interest. Guest accounts may have restricted visibility

● Flow Filtering Expression – Enter a filtering expression for flows. Click the star icon for syntax details. Common expressions can be saved/reused

● Top Type – What the top ranks. Flow Records, the default, ranks aggregated flows; every other choice ranks a single field: the IP addresses (Any, SRC or DST), ports, interfaces, AS numbers (including Prev AS and Next AS), countries, next-hop and router IPs, protocol, direction, TOS, mask bits, VLAN IDs, MAC addresses, MPLS labels 1–10, client, server and application latency, and others such as Ja3 Hash, observation point and domain, the VRFs, and Nbar ID

● Order By – The unit the top is ranked by: Flows (the default), Packets, Bytes, Pkts/s, Bytes/s, or Bytes/Pkt

● Export – The output can be shown in HTML, TEXT, JSON, or CSV, converted to PDF, emailed, or printed. If you need to query a very large volume of flows, avoid listing them all in the browser – the page may time out. In that case, choose CLI to see the shell command used for listing flows, then run that command from the shell and redirect the output to a file (the CLI option is not shown to guest accounts)

● Time Range – Select a predefined time range, or Custom… to specify an exact interval. Only flows that started or ended within the selected interval are shown. Time zone differences between the Console server and remote Flow Sensor servers are not adjusted automatically

● Top – Rank the first 10, 20, 50 (the default), 100, 200 or 500 entries. To list more, use the CLI export option

● Aggregation – The aggregation options — the same ones as the Flow Records sub-tab — take effect only when Top Type is Flow Records, and are ignored for every other Top Type, which already implies its own grouping

● Limit – Keep only the entries whose Packets or Bytes are > or < a value; the value takes a K, M or G suffix, and 0 disables the limit

● Display – Compact or Custom… — the Tops sub-tab has no Extended or Full layout. Custom… reveals a Custom Format field for your own nfdump-style format string

● Display Options – Configure how columns are shown: IP Addresses can be displayed as Numeric, Mixed, or Hostname, optionally with Show Country; Raw Values toggles unformatted ASNs, Dates, Ports, Protocols, and Units; Switch Bytes with Bits displays byte counters as bits. Check Include Unmonitored Ifs to add flows from interfaces not monitored by Flow Sensor but exported by the flow exporter; this also lifts the time-window restriction applied when reading flow data files

● Refresh – Press Generate to run the query, or select an automatic refresh interval

Note

The raw flow data is saved on disk in five-minute intervals, so a flow can take up to five minutes after being sent before it becomes queryable.

If no data is shown and the Flow Sensor is not running on the Console server, follow the NFS configuration steps.

35.3. Flow Graphs

In this sub-tab you can build interactive charts from flow data along one or more dimensions. It requires at least one Flow Sensor configured to store flow data in ClickHouse — see the Flow Collector options of the Flow Sensor. Charts are rendered in the browser and support click-to-zoom and rich tooltips.

● Sensor Interfaces – Select interfaces of interest. Guest accounts may have restricted visibility

● Flow Filtering Expression – Enter a filtering expression for flows. Click the star icon for syntax details. Common expressions can be saved/reused

● Graph Type – Stacked Areas (default), Stacked 100%, Lines, Grid, Sankey, or Heatmap. Sankey diagrams visualize how traffic maps between two dimensions (for example, DST IP Address to DST Port), so they require selecting two Dimensions

● Unit – The unit used to build the series: Bits/s, Bytes/s, Packets/s, or Flows/s

● Dimensions – One or two flow fields to group traffic by. Most fields present in flow data are available: SRC/DST IP Address, SRC/DST AS, DST 1st/2nd/3rd AS, SRC/DST Country, SRC/DST Geo City and State, SRC/DST Port, SRC/DST Net Name, Protocol, Application, Flow Direction, Flow Class, Forwarding Status, EtherType, Packet Size, TCP Flag, Min/Max TTL, as well as Sensor Name, Exporter Group, IN/OUT Sensor Interface, and the IN/OUT Interface attributes (name, speed, connectivity, provider, boundary)

● IPv4 / and IPv6 / – Collapse the IP Address dimensions into subnets of the given prefix length

● Limit and Order By – Chart only the top <number> series, ranked by Min, Max, Last, Average, ~95th, or Total

● Time Range – Select a predefined time range, or Custom… to specify an exact interval

● Export – The chart can be emailed, printed, or exported to PDF, TEXT, JSON, CSV, or PNG

● Display Options – Configure how IP addresses (numeric, mixed, hostname, with country), ASNs, ports, protocols, and units are displayed. Check Include Unmonitored Ifs to add flows from interfaces not monitored by Flow Sensor but exported by the flow exporter

● Refresh – Press Generate to build the chart, or select an automatic refresh interval

Note

The SRC/DST IP Address, SRC/DST Port, TCP Flag, and Min/Max TTL dimensions are only stored with raw flow data, not in long-term rollups, so charts using them are limited to the retention period of raw flows.