Query/Report with Query Type "Destination IPs ranked by Bytes Transmitted"

Maxim Zimovets · ‎06-04-2008

Hello, all!

Dear colleagues, I run into following situation:

I try to set Query/Report with Query Type set to "Destination IPs

ranked by Bytes Transmitted".

When I press Query or Submit Inline I got necessary data followed by

"Total Bytes Transmitted" (all calculated data).

It's Ok. But when I run Report "Total Bytes Transmitted" is missing.

Can anybody explain me why?

With best regards

Maxim

Farrukh Haroon · ‎06-05-2008

Hello

I could not locate any thing related to this in the bug toolkit, I will replicate this report in one of our customer's MARS boxes and let you know. However this will not be possible before Saturday morning, when I visit the customer.

The only bug I found 'similar' to this was:

CSCsd84094, but still it is a little different.

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsd84094&from=summary

Regards

Farrukh

Maxim Zimovets · ‎06-05-2008

Hello!

Thank You, Farrukh, for such fast reply.

I forgot to mention - I tested my problem on MARS 4.3.4 and 5.3.4. Results were the same.

Pointed by you bug, I think, not applicable to my case, because symptoms and conditions are a bit different.

I suppose, the problem lies in a way how MARS handles Netflow (because such counters can be obtained only with Netflow). But I'm not really sure.

Anyway, I will wait for any solution.

With best regards,

Maxim.

Farrukh Haroon · ‎06-07-2008

Hello, I just tested this in one of our boxes running 4.3.4. And it seems the behaviour I'm seeing is exactly the same as reported by you. Query shows the Total, the report doesnt.

Why, I guess only the TAC/Dev guys could comment. For others like reports/queries based on No of Sessions, the Total Events is displayed even in the Report.

Regards

Farrukh

Maxim Zimovets · ‎06-07-2008

Hello, Farrukh.

Thank you for your answer.

Ok, I will open a request in TAC with the problem.

With best regards,

Maxim

Farrukh Haroon · ‎06-07-2008

Interestingly, If I re-use that report to generate a query using the "Load Report as On-Demand Query with Filter" option on the Query page, I can get the "Total Bytes Transmitted". value.

Also please note that we don't have any device sending NetFlow output to this box, yet it can still generate this query/report. I think the FWSM syslog is aiding in populating this report.

Regards

Farrukh

mhellman · ‎06-10-2008

FWIW, the Checkpoints also generate byte data. In fact, you should find that netflows are unnecessary in some cases where you already have a firewall reporting into MARS.