Skip to main content
Version: 2.10.0

Network Subnets Monitor (10011 / 20011)

Description

This Module reports top bandwidth consumers for each monitored subnet. This information is provided per NetFlow exporter and monitored subnet.

Parameters

Parameter NameDescriptionComments
Data Collection Interval, secModule logic execution intervalmin = 10 sec, max = 600 sec, default = 30 sec
Monitored subnet IPv4 address and subnet maskList of the watched subnets’ IPv4 addresses and masks (CIDR notation)e.g. 67.202.0.0,18; 72.44.32.0,24
Monitored subnet IPv6 address and subnet maskList of the watched subnets’ IPv6 addresses and masks (CIDR notation)e.g. 2620:0:2d0:200::7,24
N – number of reported hostsTop N (number of reported hosts per subnet)min = 0, max = 100000, default = 50 (0 indicates all hosts are reported)

Input

NetFlow v5, v9, IPFIX, Cisco ASA NSEL, sFlow.

Required NetFlow Fields

Information Element (IE)IE idIE size, BDescription
sourceIPv4Address or sourceIPv6Address8 or 274 or 16The IPv4 or IPv6 source address in the IP packet header
destinationIPv4Address or destinationIPv6Address12 or 284 or 16The IPv4 or IPv6 destination address in the IP packet header
protocolIdentifier41The value of the protocol number in the IP packet header. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry.

Syslog/JSON Message Fields

KeyField DescriptionComments
nfc_idMessage type identifiernfc_id=20011
exp_ipNetFlow exporter IP address<IPv4 address>
subnetSubnet IPv4<IPv4 address>
subnetSubnet IPv6<IPv6 address>
maskMask<number>
src_ipSource host IPv4 address<IPv4 address>
src_ip6Source host IPv6 address<IPv6 address>
protocolTransport Protocol ( TCP = 6, UDP = 17)<number>
bytes_outBytes Out (Traffic)<number>
bytes_inBytes In (Traffic)<number>
packets_outPackets Out count<number>
packets_inPackets In count<number>
flow_countNumber of flows<number>
percent_of_totalPercent of Total Traffic of the Source Host within Subnet<decimal>, e.g. 25.444% is 25.444
t_intObservation time interval, msec<number>