FlowGrapher

FlowGrapher

The FlowGrapher tool creates graphical reports according a user specified filter.

* Period Start Time	* Period End Time	* Protocol	* TCP Flags
* Source Address	* Source Port	* Source AS	* Source Interface
* Destination Address	* Destination Port	* Destination AS	* Destination Interface

These filtering criteria are common to the other tools, FlowViewer and FlowTracker, as well. The Reporting Parameters are different between the tools and allow the user to control the output of the reports. The FlowGrapher input screen appears in the middle panel keeping the Dashboard graphs in view. An example FlowGrapher input screen is shown in Figure 3 below:

Figure 3 - FlowGrapher Input Screen

FlowGrapher Reporting Parameters allow the user to modify the reported output. These parameters include:

* Graph Type (e.g., Bits/sec)	* Statistics From (e.g., non-zeroes)	* Resolve Addresses	* Graph Width
* Bucket Size	* Sampling Multiplier	* Detail Lines	* Include Flow If

The FlowGrapher Input screen shown above also includes a SiLK directory selection parameter. The user may select SiLK capture directories to choose from including 'all.' This option field appears when the user has selected a device that is exporting to a SiLK collector. This option will not appear when a device is exporting to flow-tools. Each of the other tools behaves the same.

Netflow data is parsed according to the user supplied filter and data that passes the filter in accumulated into time buckets and graphed. The user can vary the bucket size (1 - 60 seconds). An example FlowGrapher output screen is shown in Figure 4 below. The user may click on any column and the report will sort by that column. From the FlowGrapher report screen the user may save either the filter or the report itself from the buttons in the bottom margin. Figure 4 also shows the pull-down that provides access to all saved reports. This pull-down has an option for managing the saved reports (e.g., deleting, etc.). Saved filters are accessed from the three tool input screens and an option to manage them is available on the Saved Filter pull-down as well.

Figure 4 - FlowGrapher Output Screen