IP groups

The IP statistics can also be summarized for a group of IP addresses. This is useful for getting an overview of the traffic of a specific part of the network, for instance all servers or client PCs. Any IP subnet can be configured to be used as a group and the statistics will then show the amount of traffic for all IP addresses within the subnet, its peer addresses and so. Multiple IP groups can overlap so that an IP address is part of multiple IP groups. When Virtual Link Groups are defined, the IP group is accounted separately for each Virtual Link Group.

The name of a matching IP group is shown in all places where IP names are shown to make it easy to identify the IP address details. For example, if IP groups are defined for multiple data center locations (each having a different IP subnet), the name of the data center is visible for each IP address in its subnet. Filtering for those names is also possible in the IP list to be able to find IP addresses.

IP groups

The statistics available for each group are almost identical as for individual IP addresses. The IP groups tab lists the groups and their traffic just like the IP addresses tab lists the IP addresses and their traffic. Clicking on a group name leads to the group detail view which is similar to the IP detail view. For a group, you can see the amount of traffic, the protocols used, the peer IP addresses, open TCP ports, and TCP statistics.

In addition to the IP details view, there are additional tabs:

• List of IPs: This shows the traffic statistics for the IP addresses of this group.
• Peer groups: This shows the traffic statistics originating from this group to other groups and vice versa.
• Peers: This is the list of IPs that have traffic with IPs of the group. Traffic between IPs both within the group is also seen here.

By clicking on the small graph icon in the heading and next to a graph, a dialog will be displayed which allows for selecting the visible graph.

Capturing traffic for a group will capture the network traffic of all IP addresses within this group.

IP group pairs

This page shows statistics about all IP group pairs that had traffic with eachother. Only 1000 entries can be displayed at any time. If there more pairs, consider setting a filter to see the other IP group pairs.

If the page takes too long to update, automatic update will be disabled and an "Update" button appears similar to the global connection page.

Configuration

To configure groups, click on the tab Configure groups. The page allows to add new groups by clicking on the plus button in the first column. Existing groups can be removed by clicking the corresponding minus button. For each group, a name can be entered. Then the subnets or IP ranges (Firmware >= 4.3) for this group must be configured by clicking on Add subnet/range button on right side of the page. The subnet must be entered as an IP address and the mask prefix.

Examples are

• 10.1.2.3/8 for a class A subnet
• 192.168.1.0/24 for a class C subnet
• 10.0.0.3-10.0.0.42 for IP range.

Multiple subnets per group are possible.

It is possible to enable burst analysis for an IP group. The Rx and Tx speed values for 100% utilization can be configured.

With the search field above the list of groups the list can be filtered by entering a name or an IP address. If an IP address is entered all groups will be shown that contain the given IP in one of their subnet configurations.

To apply the configuration press on the Save button. The changes take effect immediately. The number of possible IP groups is limited by a global configuration setting in the IP module configuration section (see below for detailed information about these settings). By default, up to 32 IP groups can be configured. The maximum number of IP groups can be increased to 65535. Increasing the maximum number of IP groups reduced the available memory for measurement data so it should only set to the value necessary for the actual use case to avoid wasting memory for unused IP groups.

IP groups may overlap which means that an IP address is allowed to be part of multiple groups. The traffic counters for that IP will be accounted for all matching groups so the total sum of the traffic of those groups will be higher than the sum of the individual IPs.