topic RE: purview: report how to show bidirectional traffic in ExtremeCloud IQ- Site Engine Management Center

purview: report how to show bidirectional traffic

Rainer_Adam — Wed, 03 Jun 2015 11:55:00 GMT

Our customer has a mid-size Network with Enterasys components S8 in the Core.

PurView, NAC-GW's and Netsight are Version 6.1.0.182. ALL ports from the S8 are policy based mirrored to the PurView Gateway.

Following, simple request:

"Show me with which devices the D2 Switch with IP 10.255.255.150 talks SNMP"

If I start a "Report" with "Network Activity for a Client", set the Client IP Address to 10.255.255.150 I can see there 4 Applications SNMP, NTP, ICMP and TFTP.

If I here click to "SNMP" I will see ALL mirror SNMP traffic but NOT the Device I searched for... (there are about 100 Switches within that LAN).

What is the best way to fullfill this request?

RE: purview: report how to show bidirectional traffic

Mike_Thomas — Wed, 03 Jun 2015 23:55:00 GMT

Rainer,
I have duplicated your results in the lab and discussed with development. The closest you can come to this is searching via the application flows for server=10.255.255.150, app=SMMP
This is not "reporting data" as much as short term flow data that is stored in the database for a short amount of time, typically not more than 4 hrs.

RE: purview: report how to show bidirectional traffic

Frank_Thomas — Thu, 04 Jun 2015 00:39:00 GMT

An Active view is pretty easy
In the flow tab
"SIP=#SwitchIP,app=snmp"

RE: purview: report how to show bidirectional traffic

Rainer_Adam — Fri, 05 Jun 2015 11:15:00 GMT

I am sorry, but there is nothing to see, if I set the filter on Server (or even also on client) to the switch ip address there is nothing to show. Those device(s) will be polled every 30 seconds by the Netsight Server and CA Spectrum is also polling all the devices. So it could NOT happen that there was NO traffic from / to this switch within the last 4 hours. Maybe too less to hold it in the Database, but that would be pretty bad if we cannot trust the data we see (or not).

I will open a GTAC Case for this.

RE: purview: report how to show bidirectional traffic

Rainer_Adam — Fri, 05 Jun 2015 11:29:00 GMT

Extreme Networks GTAC Case # (01127878)

RE: purview: report how to show bidirectional traffic

Mike_Thomas — Mon, 08 Jun 2015 19:23:00 GMT

Rainer and I resolved this in the case.

RE: purview: report how to show bidirectional traffic

Ryan_Mathews — Mon, 08 Jun 2015 19:23:00 GMT

Nice job Mike!

https://gtacknowledge.extremenetworks.com/articles/Q_A/Reviewing-Oneview-Pureview-output-for-SNMP-application

RE: purview: report how to show bidirectional traffic

Rainer_Adam — Tue, 16 Jun 2015 18:48:00 GMT

YES, thanks again Mike for support.

It is very simple (if you know it 😉 ) Go to "Application" and there to "Application flows" on the right side you can see the "search" line. This is NOT simply a text field to search for, I REALLY recommend you to click to the help text and to "more" within there....