Using NetFlow Groups

In some cases, you may prefer to track a range of IP addresses as belonging to a different domain, top level domain, or country than the IP addresses resolve to. For example, internal IP addresses do not usually have host names registered on a domain name server, so NetFlow Monitor cannot automatically determine their domains, top level domains, or countries.

To overcome this limitation, NetFlow Monitor lets you use Groups to override the domain, top level domain, and country of ranges of IP addresses so that each group can be tracked as a whole. This allows you to easily track sections of your internal network so that you can view reports by divisions, departments, or other groupings.

Tip: After you configure a group, you can use that group's name to filter reports to show only the traffic sent to or received by devices that belong to the group.

To create or edit a group:

1. From any workspace view or report in the web interface, select GO. The GO menu appears.
2. If the NetFlow section is not visible, click NetFlow. The NetFlow section of the GO menu appears.
3. Select Configure > NetFlow Groups. The NetFlow Groups dialog appears.
4. Click New. The NetFlow Group dialog appears.

   - or -
   Select a group, then click Edit. The NetFlow Group dialog appears.

5. Enter or select the appropriate information in the following fields.
   • Group. Enter a name for the NetFlow group.
   • IP Range Start. Enter the first IP address for the NetFlow source group range.
   • IP Range End. Enter the last IP address for the NetFlow source group range.
   • Domain. Enter the domain that you want NetFlow Monitor to report for the specified IP addresses. For example, yourcompany.com.
   • Top Level Domain. Select the domain that you want NetFlow Monitor to report for the specified IP addresses. For example, com.
   • Country. Select the country that you want NetFlow Monitor to report for the specified IP addresses.
6. Click OK to save changes.