What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general.

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags


View all Tags

Displaying Inbound and Outbound traffic seperately on the same graph

Votes:

0

I am using a NetFlow 9 Sensor, but want to show Inbound and Outbound traffic separately on the same graph.

I'm sure this must be pretty simple but have been unable to find out how to do it.

Can you assist please?

Thanks

Mike

display graphs netflow

Created on Nov 30, 2010 7:42:21 AM



15 Replies

Votes:

0

Hello,

with the detailed Bandwidth sensors (Flow and Packet Sniffing) PRTG cannot know what might be inbound and what outbound traffic (as for SNMP Traffic sensors, PRTG gets told from the corresponding device what is in- and what is out- Traffic). Therefore, you would have to use filters or an appropriate Channel Definition on a Custom Netflow Sensor to define what falls under inbound traffic, and what under outbound.

Best Regards.

Created on Nov 30, 2010 2:14:43 PM by  Torsten Lindner [Paessler Support]

Last change on Dec 2, 2021 10:15:47 AM by  Maike Guba [Paessler Support] (2,404) 2 1



Votes:

0

Hi Torsten

Thanks heaps for your help. I'm up and running with SNMP, and displaying the graphs with inbound and outbound as expected.

But please forgive my ignorance. I've lost the ability to filter based on IP now. Perhaps I should explain what I am trying to do.

We are an small ISP, providing services to multiple customers, and want to provide traffic graphs for each customer based on their IP address (in some cases the customer has more than one IP address).

This worked great under NetFlow, since we could filter by IP, but the graphs did not show In and Out traffic.

SNMP shows the graphs how we want them, but how do we create a sensor which filters based on IP address (or number of IP addresses). I'm sure this is in the manual somewhere, but as always I have a deadline and no spare time to sit and read it!!

Thanks again for your help.

Mike

Created on Nov 30, 2010 5:45:11 PM



Votes:

0

Dear Mike,

SNMP can't filter for IPs. It doesn't have the necessary detailed information about the traffic. That's only possible with Flow or Packet-Sniffing.

Best Regards.

Created on Nov 30, 2010 6:33:26 PM by  Torsten Lindner [Paessler Support]

Last change on Dec 2, 2021 10:15:57 AM by  Maike Guba [Paessler Support] (2,404) 2 1



Votes:

0

Torsten

So are you saying we are unable to achieve the result we are looking for using either SNMP or NetFlow and PRTG Network Monitor?

Regards

Mike

Created on Nov 30, 2010 8:40:18 PM



Votes:

0

Dear Mike,

you can do this with Netflow sensors. If you would add a new Custom Netflow Sensor with the following (just "sketchy" channel definition) for say Customer A (with the internal IP 10.0.1.188):

#1: Traffic In
SourceIP[10.0.1.188]
#2: Traffic Out
DestinationIP[10.0.1.188]

This should give you Traffic In & Out for this internal IP, based on the Netflow information. You can of course use an OR relation if Customer B (for example) would have 2 (or more) internal IPs. Furthermore, if there is no traffic between the IPs of different customers, it should be possible to perform this with one additional Custom Netflow Sensor. You could then use one Sensor Factory Sensor per Customer if you need to have one In/Out-Sensor per Customer, the reason for this suggestion would be to not have too many "useless" Netflow Sensors, as some would hold the same Toplists. And Toplists can be quite a load for PRTG.

Best Regards.

Created on Nov 30, 2010 10:28:42 PM by  Torsten Lindner [Paessler Support]



Votes:

0

Hello i hava a problem with set netflow v5. Can I separate in out flow on a single router?

Created on May 16, 2011 2:25:37 PM



Votes:

0

Only with Custom Netflow Sensors I'm afraid.

Created on May 16, 2011 2:47:56 PM by  Torsten Lindner [Paessler Support]



Votes:

0

Can someone please explain in more detail how to separate the traffic? I have multiple subnets inside my LAN, using a router to access the internet. Do I need to write a filter that lists all the subnets, or is there a clever way to identify inbound and outbound traffic? If there isn't, is this the correct syntax?

#1: Traffic In
(DestinationIP[192.168.0.0/23] or DestinationIP[192.168.30.0/24] or DestinationIP[192.168.40.0/24])
and not
(SourceIP[192.168.0.0/23] or SourceIP[192.168.30.0/24] or SourceIP[192.168.40.0/24])

Is there no way to define what subnets are internal?

Created on Mar 8, 2018 2:11:40 AM

Last change on Mar 8, 2018 9:32:21 AM by  Torsten Lindner [Paessler Support]



Votes:

0

Peter, you could try working with the inbound/outbound-interface filters instead.

Created on Mar 8, 2018 9:32:41 AM by  Torsten Lindner [Paessler Support]



Votes:

0

Where do I find those? Are you talking about a style of filter, or some other place in the program?

Created on Mar 14, 2018 2:05:37 AM



Votes:

0

You can use these as Filters or in the Channel Definition.

Created on Mar 14, 2018 1:26:06 PM by  Torsten Lindner [Paessler Support]



Votes:

0

Oh, you mean filtering on the InboundInterface and OutboundInterface fields? Is there an easy way of working out what the interface numbers are?

Created on Mar 14, 2018 8:26:41 PM



Votes:

0

I'm afraid not. The best way is to enable the Log Stream Data to Disk (for Debugging) for All Stream Data in the settings of the flow sensor. The resulting CSV-file should feature the interface numbers. From this a bit of guess work may be necessary to estimate from certain traffic which interface number must be which actual interface.

Created on Mar 15, 2018 1:11:09 PM by  Torsten Lindner [Paessler Support]



Votes:

0

Done, thanks for that. On two routers, most traffic has the interface number 1, but on another it's 14. Where do those numbers come from?

Lots of flows use other interface numbers, but it doesn't add up to much, so I'm happy to leave that as Other.

If there was a way to assign interface numbers to channels automatically, that would have let me easily see which numbers to use, instead of analysing stream logs.

Created on Mar 18, 2018 8:37:37 PM



Votes:

0

Done, thanks for that. On two routers, most traffic has the interface number 1, but on another it's 14. Where do those numbers come from?

I'm afraid that would be a question for the device vendor then.

Lots of flows use other interface numbers, but it doesn't add up to much, so I'm happy to leave that as Other.
If there was a way to assign interface numbers to channels automatically, that would have let me easily see which numbers to use, instead of analysing stream logs.

Sorry that is not possible.

Created on Mar 19, 2018 11:02:14 AM by  Torsten Lindner [Paessler Support]




Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.