Displaying Inbound and Outbound traffic seperately on the same graph

Hello,

with the detailed Bandwidth sensors (Flow and Packet Sniffing) PRTG cannot know what might be inbound and what outbound traffic (as for SNMP Traffic sensors, PRTG gets told from the corresponding device what is in- and what is out- Traffic). Therefore, you would have to use filters or an appropriate Channel Definition on a Custom Netflow Sensor to define what falls under inbound traffic, and what under outbound.

Best Regards.

Hi Torsten

Thanks heaps for your help. I'm up and running with SNMP, and displaying the graphs with inbound and outbound as expected.

But please forgive my ignorance. I've lost the ability to filter based on IP now. Perhaps I should explain what I am trying to do.

We are an small ISP, providing services to multiple customers, and want to provide traffic graphs for each customer based on their IP address (in some cases the customer has more than one IP address).

This worked great under NetFlow, since we could filter by IP, but the graphs did not show In and Out traffic.

SNMP shows the graphs how we want them, but how do we create a sensor which filters based on IP address (or number of IP addresses). I'm sure this is in the manual somewhere, but as always I have a deadline and no spare time to sit and read it!!

Thanks again for your help.

Mike

Dear Mike,

SNMP can't filter for IPs. It doesn't have the necessary detailed information about the traffic. That's only possible with Flow or Packet-Sniffing.

Best Regards.

Torsten

So are you saying we are unable to achieve the result we are looking for using either SNMP or NetFlow and PRTG Network Monitor?

Regards

Mike

Dear Mike,

you can do this with Netflow sensors. If you would add a new Custom Netflow Sensor with the following (just "sketchy" channel definition) for say Customer A (with the internal IP 10.0.1.188):

#1: Traffic In
SourceIP[10.0.1.188]
#2: Traffic Out
DestinationIP[10.0.1.188]

This should give you Traffic In & Out for this internal IP, based on the Netflow information. You can of course use an OR relation if Customer B (for example) would have 2 (or more) internal IPs. Furthermore, if there is no traffic between the IPs of different customers, it should be possible to perform this with one additional Custom Netflow Sensor. You could then use one Sensor Factory Sensor per Customer if you need to have one In/Out-Sensor per Customer, the reason for this suggestion would be to not have too many "useless" Netflow Sensors, as some would hold the same Toplists. And Toplists can be quite a load for PRTG.

Best Regards.

Hello i hava a problem with set netflow v5. Can I separate in out flow on a single router?

Only with Custom Netflow Sensors I'm afraid.

Can someone please explain in more detail how to separate the traffic? I have multiple subnets inside my LAN, using a router to access the internet. Do I need to write a filter that lists all the subnets, or is there a clever way to identify inbound and outbound traffic? If there isn't, is this the correct syntax?

#1: Traffic In
(DestinationIP[192.168.0.0/23] or DestinationIP[192.168.30.0/24] or DestinationIP[192.168.40.0/24])
and not
(SourceIP[192.168.0.0/23] or SourceIP[192.168.30.0/24] or SourceIP[192.168.40.0/24])

Is there no way to define what subnets are internal?

Peter, you could try working with the inbound/outbound-interface filters instead.

Where do I find those? Are you talking about a style of filter, or some other place in the program?

You can use these as Filters or in the Channel Definition.

Oh, you mean filtering on the InboundInterface and OutboundInterface fields? Is there an easy way of working out what the interface numbers are?

I'm afraid not. The best way is to enable the Log Stream Data to Disk (for Debugging) for All Stream Data in the settings of the flow sensor. The resulting CSV-file should feature the interface numbers. From this a bit of guess work may be necessary to estimate from certain traffic which interface number must be which actual interface.

Done, thanks for that. On two routers, most traffic has the interface number 1, but on another it's 14. Where do those numbers come from?

Lots of flows use other interface numbers, but it doesn't add up to much, so I'm happy to leave that as Other.

If there was a way to assign interface numbers to channels automatically, that would have let me easily see which numbers to use, instead of analysing stream logs.

Done, thanks for that. On two routers, most traffic has the interface number 1, but on another it's 14. Where do those numbers come from?

I'm afraid that would be a question for the device vendor then.

Lots of flows use other interface numbers, but it doesn't add up to much, so I'm happy to leave that as Other.
If there was a way to assign interface numbers to channels automatically, that would have let me easily see which numbers to use, instead of analysing stream logs.

Sorry that is not possible.