If you wish to compare the traffic usage of multiple subnets in the same flow sensor or filter out a specific subnet in your flow, please check the two alternatives below:
1. You can have multiple sensors monitoring each subnet, you can use the Filtering option within the sensor's settings to create various distinct sensors, one for each sub-net (and set the filters accordingly):
For instance if you have multiple /24 subnets within the 192.168.0.0 network, create distinct sensors and set the following filters:
IP[192.168.10.0/24]
IP[192.168.11.0/24]
IP[192.168.12.0/24]
2. On the other hand if you want to have all subnets within a same sensor, listing only the total bandwidth (and not per protocol) you can check the (Custom) variant of the flow-based bandwidth sensors, leave the filters empty and use a channel definition similar to the following:
#1:Subnet 10 Traffic
IP[192.168.10.0/24]
#2:Subnet 11 Traffic
IP[192.168.11.0/24]
#3:Subnet 12 Traffic
IP[192.168.12.0/24]
The same rules will also apply (on both cases) if you want to filter a specific host only, for instance IP[192.168.10.123].
For further details about the syntax for filter rules please check:
Note: In both examples above the sensors would also take into account the traffic that goes from one subnet to the other (internal), if you're only interested in traffic that goes to the internet, use the AND filter to include some other condition, for instance Port[] or similar to further filter refine the filter rules.
Best Regards,
Luciano Lingnau [Paessler Support]
Add comment