FlowViewer

FlowViewer

The FlowViewer tool creates textual reports according a user specified filter. Over a dozen reports are currently offered. The filtering criteria fields include:

* Period Start Time	* Period End Time	* Protocol	* TCP Flags
* Source Address	* Source Port	* Source AS	* Source Interface
* Destination Address	* Destination Port	* Destination AS	* Destination Interface

These filtering criteria are common to the other tools, FlowGrapher and FlowTracker, as well. The Reporting Parameters are different between the tools and allow the user to control the output of the reports. The FlowViewer input screen appears in the missle panel keeping the dashboard graphs in view. An example FlowViewer input screen is shown in Figure 1 below. The FlowViewer Input screen is not showing the SiLK directory selection parameter (see the FlowGrapher wiki section for this.)

Figure 1 - FlowViewer Input Screen

FlowViewer Reporting Parameters allow the user to modify the reported output. These parameters include:

* Statistics Report	* Printed Report	* Resolve Addresses	* Pie Charts
* Octet Units	* Sampling Multiplier	* Cutoff Lines	* Cutoff Octets

Netflow data is parsed according to the user supplied filter and the selected report is generated. The user may select to see a pie chart summary of the results. An example FlowViewer output screen is shown in Figure 2 below. The user may click on any column and the report will sort by that column. From the FlowViewer report screen the user may save either the filter or the report itself from the buttons in the bottom margin. See the FlowGrapher wiki section to see how saved reports are accessed. The report shown in the figure below is displaying IPv6 addresses. Note that this requires SiLK version 3.0 and above.

Figure 2 - FlowViewer Output Screen