STATUS > TOP N

Features

• The drop down box at the top of the trend lists the interfaces available on the router/switch.
• The default time sample is the last 24 hours in 30 minute intervals. Real Time reports are also available and explained later in detail. Drag the mouse over the graph and let go of the mouse button to zoom in on a time period which will provide more granular time intervals.
• Navigation Tip: On any screen capture above, click on a Host or Application to gain further details.
• The watermark behind all trends is found here: ~/html/icons/scrutinizerBG.png.
• Located in the upper left hand corner, this signifies that a NetFlow is being received from this router.
• Located in the upper left hand corner, this signifies that a NetFlow is no longer being received from this router.
• Click to go back in time.
• Click to go forward in time.
• Select a custom time and then click this icon to generate.
• This column displays average bits per second for the time frame selected..
• This column displays last interval for the time frame selected.
• This column displays the maximum interval for the time frame selected.
• This column displays total bits for the time frame selected.
• Click on the 1 icon to view 24 hours worth of data in half hour intervals. Drag the mouse over the graph to zoom in for more granular time intervals (e.g. down to 1 minute intervals).
• Click on the 7 icon to view 7 days worth of data in 12 hour intervals. Drag the mouse over the graph to zoom in for more granular time intervals. (e.g. down to 1 minute intervals)
• Click on the 31 icon to view 31 days worth of data in 1 day intervals. Drag the mouse over the graph to zoom in for more granular time intervals. (e.g. down to 1 minute intervals)
• Click on the 365 icon to view 365 days worth of data in 7 day intervals. Drag the mouse over the graph to zoom in for more granular time intervals. (e.g. down to 1 minute intervals)
• Clicking on the detach icon will launch a popup window of the data currently displayed.
• This icon indicates the Destination of the conversation.
• This icon indicates the Source of the conversation.

Menu Options

There are a several navigation options using the data displayed in this screen:

Click on this icon to display the drop down menu and select one of the options below.

• Click on the Out Bound icon to see data going out this interface.
• Click on the In Bound icon to see data coming in this interface.
• Click on the wrench icon to view the SNMP information in the database for this router. Specifically, Scrutinizer displays the System information using OID: 1.3.6.1.2.1.1 and the interface information.
• Click on the binoculars to search for a specific user or application.
• Click on this icon to schedule the report for automated emailing on a regular basis. Click Here to learn more about this feature.
• Click on this icon to remove the gray "other" traffic from the historical trend.
  NOTES:
  * other traffic will not appear correctly if NetFlow is not configured correctly.
  * other traffic will not represent true traffic volume when dealing with sFlow. This is due to the sampling limitation of sFlow.
• Click on this icon to put back the gray "other" traffic in the historical trend.
• Click on this icon to view traffic from midnight to midnight
• Click on this icon to view the full utilization of the interface. This icon will pop up a window displaying the full utilization in and out on this interface in daily, weekly, monthly and full year format. Click Here to learn more about this feature.
• Click this icon to trend and stack the top ten displayed in the current pie chart.
• Click this icon to summarize the current trend into a pie chart. Only the top 10 will be compiled into the pie.
• Click this icon to trend the data in percent utilization. Scrutinizer must know speed of the interface to calculate this. Click on the SNMP icon to configure the interface speed manually.
• Click this icon to trend the data in bits per second in lieu of percent utilization. This is very important as of low volume data will not show up using the % utilization icon.
• 
  Hosts: Click on the ID card and Scrutinizer will attempt to DNS resolve all of the IP addresses listed below to host names.

Applications: Click on the ID card and Scrutinizer will bring up a screen from Settings -> Known Applications and allow the protocol to be defined. This ensures that in the future, the protocol number will show up with a descriptive name in lieu of a number. Google.com is an excellent resource for researching what applications belong to a protocol.
• Click on the Real Time icon and Scrutinizer will trend the interface realtime (i.e. every 5 seconds) using SNMP. Make sure the community string for this device is configured correctly.
• Click on the magnifying glass to view the flog.
• Click on the police man to launch an email to the ISP responsible for the IP address (i.e. host). This email is generally sent in hopes of encouraging the service provider to do something about the user sending traffic to this network.
• Click on the ID card and Scrutinizer will attempt to DNS resolve the individual IP address to a host name.
• Click the globe icon to launch a web browser to the host listed. NOTE: This icons execution can be modified to launch a favorite 3rd party application. Visit Settings -> Configuration -> External Link to modify the action when clicking this icon.
• Click on the Conversation icon to display the top conversations for the selected host or protocol.Click Here to learn more about the conversation functionality.
• View total unique in / out bound conversations to and from this host or involving a selected protocol. NOTE: this option only available in trends displaying 1 minute intervals.
• View total unique in / out bound traffic for the selected host or protocol. NOTE: this option only available in trends displaying 1 minute intervals.

Real Time

Important:

• Real Time is dependent on SNMP. Make sure the community string for this device is configured correctly.
• Keep in mind that NetFlow is exported when the conversation ends (i.e. a 400K conversation that took 30 seconds and ends will be exported by the router in a single packet with up to 29 other conversations i.e. flows). What can be done to reduce this problem? The Cisco command below breaks up long-lived flows into 1-minute segments. You can choose any number of minutes between 1 and 60; if you leave the default of 30 minutes you will get spikes in your utilization reports.
  Command to type: ip flow-cache timeout active 1

Click Here to learn more on how to configure NetFlow on a router or switch.

NOTE: This tool times out in 5 minutes and must be restarted. Some aggregation may occur.

NOTE: Real-Time can be resource demanding. Performance will vary depending on the server's available resources.

Drag and Drill - Zooming in on a time frame

Scrutinizer includes Drag and Drill™ technology empowering the user to drag the mouse over a time sample, release and view a closer look at the top talkers and applications of a specific time frame. Learn more about Drag and Drill by clicking here

This page can be sent via email

Send Page via Email: Place multiple emails in the space separated by a "," comma. Notes can be entered and sent along with the email.

Would you like to see a feature added to Scrutinizer? Click Here and tell us about your feature request.

Next Topic: Application/User (Host) Details