Query/Report with Query Type "Destination IPs ranked by Bytes Transmitted"

Unanswered Question
Jun 4th, 2008

Hello, all!

Dear colleagues, I run into following situation:

I try to set Query/Report with Query Type set to "Destination IPs

ranked by Bytes Transmitted".

When I press Query or Submit Inline I got necessary data followed by

"Total Bytes Transmitted" (all calculated data).

It's Ok. But when I run Report "Total Bytes Transmitted" is missing.

Can anybody explain me why?

With best regards


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Farrukh Haroon Thu, 06/05/2008 - 11:16


I could not locate any thing related to this in the bug toolkit, I will replicate this report in one of our customer's MARS boxes and let you know. However this will not be possible before Saturday morning, when I visit the customer.

The only bug I found 'similar' to this was:

CSCsd84094, but still it is a little different.




Maxim Zimovets Thu, 06/05/2008 - 19:04


Thank You, Farrukh, for such fast reply.

I forgot to mention - I tested my problem on MARS 4.3.4 and 5.3.4. Results were the same.

Pointed by you bug, I think, not applicable to my case, because symptoms and conditions are a bit different.

I suppose, the problem lies in a way how MARS handles Netflow (because such counters can be obtained only with Netflow). But I'm not really sure.

Anyway, I will wait for any solution.

With best regards,


Farrukh Haroon Sat, 06/07/2008 - 03:01

Hello, I just tested this in one of our boxes running 4.3.4. And it seems the behaviour I'm seeing is exactly the same as reported by you. Query shows the Total, the report doesnt.

Why, I guess only the TAC/Dev guys could comment. For others like reports/queries based on No of Sessions, the Total Events is displayed even in the Report.



Maxim Zimovets Sat, 06/07/2008 - 03:08

Hello, Farrukh.

Thank you for your answer.

Ok, I will open a request in TAC with the problem.

With best regards,


Farrukh Haroon Sat, 06/07/2008 - 03:26

Interestingly, If I re-use that report to generate a query using the "Load Report as On-Demand Query with Filter" option on the Query page, I can get the "Total Bytes Transmitted". value.

Also please note that we don't have any device sending NetFlow output to this box, yet it can still generate this query/report. I think the FWSM syslog is aiding in populating this report.



mhellman Tue, 06/10/2008 - 05:06

FWIW, the Checkpoints also generate byte data. In fact, you should find that netflows are unnecessary in some cases where you already have a firewall reporting into MARS.


This Discussion