Yann replied on Thu, Jun 25 2009 9:03 AM

rated by 0 users

r0berth1:

but when i try to show the spacific PC or IP that went to the site, I get a blank page

Could you explain how you tried to setup the report and/or share it?

Thanks,

Yann

r0berth1 replied on Thu, Jun 25 2009 9:27 AM

rated by 0 users

I created a new Netflow-endpoint report. I can select Dest IP and FullHostname and it will show the website and IP that the traffic is going to but when i selecte the transmitter IP and or FullHostname, the report comes back blank. Here is the SQL from the one that works without the Computer name or IP.

SELECT  TOP 10000 Convert(DateTime,Floor(Cast((DateTime) as Float)),0) AS SummaryDate,
FlowCorrelation_Dest_FlowCorrelation."Domain" AS Domain,
SUM(NetflowSummary.TotalBytes) AS SUM_of_Bytes_Transferred,
Nodes.Caption AS NodeName,
FlowCorrelation_Dest_FlowCorrelation.IPAddress AS IP_Address,
FlowCorrelation_Dest_FlowCorrelation.FullHostname AS Full_Hostname

FROM
((NetflowSummary LEFT OUTER JOIN FlowCorrelation FlowCorrelation_Dest_FlowCorrelation ON (NetflowSummary.DestIPSort = FlowCorrelation_Dest_FlowCorrelation.IPAddressSort))  INNER JOIN FlowCorrelation FlowCorrelation_Source_FlowCorrelation ON (FlowCorrelation_Dest_FlowCorrelation.IPAddressSort = FlowCorrelation_Source_FlowCorrelation.IPAddressSort AND NetflowSummary.SourceIPSort = FlowCorrelation_Source_FlowCorrelation.IPAddressSort))  INNER JOIN Nodes ON (NetflowSummary.NodeID = Nodes.NodeID)

WHERE
( DateTime BETWEEN 39981.2916666667 AND 39981.7083333333 )
 AND 
(
  (FlowCorrelation_Dest_FlowCorrelation."Domain" IS NOT NULL) AND
  (FlowCorrelation_Dest_FlowCorrelation."Domain" <> '') AND
  (Nodes.Caption = 'Pascagoula_Main2811') AND
  (FlowCorrelation_Source_FlowCorrelation.IPAddress = '10.200.36.128')
)
AND
(
(EXISTS(SELECT 1 FROM NetFlowSources WITH(nolock) WHERE NetFlowSources.InterfaceID=InterfaceIDRx AND NetFlowSources.Enabled=1))
)

GROUP BY Convert(DateTime,Floor(Cast((DateTime) as Float)),0),
FlowCorrelation_Dest_FlowCorrelation."Domain", Nodes.Caption, FlowCorrelation_Dest_FlowCorrelation.IPAddress, FlowCorrelation_Dest_FlowCorrelation.FullHostname

ORDER BY SummaryDate ASC, 3 DESC