Introduction

NetFlow data describes network traffic using technical attributes such as IP addresses, ports, interfaces, AS numbers, and DSCP values. Grouping lets you associate these technical attributes with meaningful business labels.

For example, you can define a portion of your network, such as the 10.20.0.0/16 subnet or any interface whose name starts with Gi0/, and associate it with a group such as Finance or Branch Office. OpsRamp then labels matching NetFlow traffic with the configured group name. This lets you view and compare traffic by business dimensions such as department, location, application, and security zone instead of relying only on raw network addresses.

Grouping is part of NetFlows and is configured from the Grouping tab in Netflows Configurations.

Intended users: Network administrators and NOC engineers who manage NetFlow monitoring and need to analyze traffic by business unit, site, application, or security zone.

Common use cases include:

• Measuring bandwidth by department.
• Comparing traffic between sites.
• Monitoring traffic between security zones.
• Measuring traffic to cloud providers.

See Use Cases for configuration examples.

Key Concepts

Criteria are shared and reusable. You can use the same criterion in multiple groups. Changes to a criterion apply to every group that uses the criterion.

How Traffic Is Matched to a Group

OpsRamp evaluates each NetFlow record against the configured groups using the following rules:

1. Definitions within a criterion use OR logic. A criterion matches when any one of its definitions matches. For example, a criterion containing the CIDRs 10.20.0.0/16 and 10.30.0.0/16 matches addresses in either subnet.
2. Criteria within a group use AND logic. A group matches only when every criterion in the group matches. For example, a group containing an IP Address criterion for 10.20.0.0/16 and a Port criterion for 443 matches only HTTPS traffic for that subnet. It does not match all traffic for the subnet or all HTTPS traffic.
3. Source and destination are evaluated separately. A flow can belong to one group as its source and another group as its destination. For a group to match on one side of the flow, all criteria in the group must match on that same side.
4. A flow can belong to multiple groups. If a flow matches multiple groups of the same group type, OpsRamp labels the flow with all matching groups.

The following table shows the flow attribute evaluated for each criterion type:

Example

A group named Finance with the group type Department contains an IP Address criterion with the CIDR 10.20.0.0/16.

Prerequisites

Before configuring groups, ensure that the following requirements are met:

• You have the NPM_Manage permission. Without this permission, Configurations is not displayed on the Net Flows dashboard.
• NetFlow data is already being sent from an NPM Collector to OpsRamp.
• Each client can have up to 20 criteria and 20 groups.
• A group can contain up to 6 criteria, with one criterion for each criterion type.
• IP Address criteria support IPv4 addresses only.

Access the Grouping Page

1. Navigate to Infrastructure > Net Flows. The NPM dashboard opens.
2. Select Configurations. The Netflows Configurations panel opens.
3. Select the Grouping tab. The Grouping page opens.

The Grouping page contains the following areas:

• Grouping pane: The left pane lists configured groups. Each group displays its name and group type. Use the search icon to find a group by name, or select + to create a group. If no groups are configured, the pane displays No groups found.
• Criteria view: Select All Criteria in the Grouping pane to display all configured criteria. Select a group to display only the criteria associated with that group.

Manage Criteria

View Criteria

The All Criteria view displays the following information:

From this view you can:

• Select ADD to create a criterion.
• Search for a criterion by name.
• Use All Types to display criteria for selected types.
• Select REFRESH to reload the list.
• Display 20, 50, or 100 rows per page and use the pagination controls to navigate between pages.

If no criteria are configured, the view displays No criteria found.

Add a Criterion

1. From the All Criteria view, select ADD. The Add Criteria window opens.
2. From Type, select the criterion type.
3. In Criterion, enter a name for the criterion.
4. Under DEFINITIONS, select + DEFINITION, and then select a definition type. For ASN, a definition row is added directly because ASN has only one definition type.
5. Enter the value for the definition.
6. Repeat steps 4 and 5 to add additional definitions. The criterion matches when any one of its definitions matches.
7. Select ADD CRITERIA.

The DEFINITIONS section becomes available after you select a Type and enter a Criterion name. ADD CRITERIA becomes available after all definitions contain valid values.

Definition Types and Valid Values

View or Edit a Criterion

1. In the All Criteria view, hover over the criterion row and select the ⋯ (more) icon.

2. Select View details. The Edit - window opens.

3. Modify the Criterion name or definitions as required. You cannot change the Type.

4. Select SAVE.

If the criterion is used by multiple groups, OpsRamp displays:

This criterion is added to multiple groups. Saving will apply changes to all.

Select YES to apply the changes to all groups that use the criterion, or select NO to return without saving.

Copy a Criterion

Use Copy to create a criterion using the values of an existing criterion as the starting point.

1. Hover over the criterion row, select ⋯, and then select Copy. The Copy - window opens with the existing values.
2. Enter a new name in Criterion, and modify the type or definitions as required.
3. Select COPY.

Remove a Criterion

1. Hover over the criterion row, select ⋯, and then select Remove.
2. Confirm the removal.

You cannot remove a criterion that is used by a group. For these criteria, Remove is unavailable and the following tooltip identifies the groups using the criterion:

This criterion is associated with the following groups. To proceed with removal, first unmap it from these groups.

Remove the criterion from the associated groups before removing it. See View or Edit a Group.

Manage Groups

Group Types

Every group belongs to one of the following group types. You cannot change the group type after creating the group.

Create a Group

1. From the Grouping pane, select +. The Add Group window opens.
2. Under GROUP DETAILS:
   • In Name, enter a name for the group.
   • From Type, select a group type.
3. Under CRITERIA, select + CRITERIA TYPE. This option becomes available after you enter a Name and select a Type. The Add Criteria window opens.
4. From Type, select a criterion type. Criterion types that are already used by the group are not displayed because a group can contain only one criterion of each type.
5. In Criterion, do one of the following:

• Use an existing criterion: Select a criterion from the list. Its definitions are displayed for reference and cannot be modified from this window. To modify the definitions, see View or Edit a Criterion.
• Create a criterion: Select + ADD from the list, enter a name, and select ADD CRITERIA. Add definitions under DEFINITIONS as described in Add a Criterion. If no criteria exist for the selected type, enter the name directly in Criterion.

6. Select ADD CRITERIA. The criterion is added to the group as a card displaying its name, type, and definitions.
7. Repeat steps 3 through 6 to add criteria of other types. Traffic must match all criteria within a group.
8. Select ADD GROUP.

The new group appears in the Grouping pane.

To remove a criterion from the group before you save it, select the X icon on its card.

View or Edit a Group

1. In the Grouping pane, hover over the group and select the ⋯ (more) icon.

2. Select View details. The group opens.

3. Make the required changes:

   • Change the Name. The Type cannot be changed.
   • Select + CRITERIA TYPE to add a criterion of a type that the group does not use yet.
   • On a criterion card, select ⋯ > Remove to take that criterion out of the group. The criterion itself stays in All Criteria.

4. Select SAVE.

Rename a Group

1. In the Grouping pane, hover over the group, select ⋯, and then select Rename.
2. In Group Name, enter the new name.
3. Select SAVE.

Remove a Group

1. In the Grouping pane, hover over the group, select ⋯, and then select Remove.
2. In the confirmation message This group will be removed permanently., select REMOVE.

Removing a group does not remove its criteria. The criteria remain in All Criteria and can be used in other groups.

View Grouped Traffic

After traffic is labeled, group types become available as Group By fields on the NPM dashboard.

1. Navigate to Infrastructure > Net Flows.
2. Select a time range of 8 hours or less.
3. In Group By, select a group field. Each group type has two fields:

• Source <Group Type>, such as Source Department, identifies the group associated with the source of the traffic.
• Destination <Group Type>, such as Destination Department, identifies the group associated with the destination of the traffic.

4. To view the amount of traffic sent by each group, select only a Source field.
5. To view traffic between groups, select both a Source and Destination field, such as Source Department and Destination Department.

The chart and corresponding table update to display traffic based on the selected group fields.

Filter Traffic by Group

You can use group fields in the Query on the NPM dashboard to display traffic associated with selected groups.

1. Navigate to Infrastructure > Net Flows.
2. Select a time range of 8 hours or less.
3. In Query, enter a condition that uses a group field. Enter the field name as it appears in Group By and specify the group name in double quotation marks.
4. Apply the query. The dashboard displays only the matching traffic.

Group fields support the following operators:

=, !=, IN, NOT IN, CONTAINS, NOT CONTAINS, STARTS WITH, NOT STARTS WITH, ENDS WITH, and NOT ENDS WITH.

Combine multiple conditions using AND and OR.

Example Queries

Where Else You Can Use Group Fields

Group fields such as Source Department and Destination Location can be used wherever NetFlow data is filtered or grouped.

Use Cases

The following examples identify the criteria and groups to create and the Group By fields to select on the NPM dashboard. Replace the example addresses and values with values appropriate for your environment.

Select a time range of 8 hours or less when viewing the results.

Measure Bandwidth by Department

Goal: Determine how much traffic each department generates.

View the result: Group By Source Department to rank departments by the traffic they send. Add Destination Department to see traffic between departments.

Understand Traffic Between Sites

Goal: Identify which offices exchange the most traffic, for example, before resizing WAN links.

View the result: Group by Source Location and Destination Location to view traffic between offices. Group by Source Connectivity to view the amount of traffic entering through WAN interfaces.

Watch Traffic Between Application Tiers

Goal: Verify that web servers reach databases only through the application tier.

View the result: Group by Source Application and Destination Application. Traffic from Web Tier to DB Tier identifies direct access that bypasses the application tier.

Monitor Traffic Between Security Zones or Environments

Goal: Verify that zones that must remain separate do not exchange traffic, such as a cardholder-data zone and guest network, or staging and production environments.

View the result: Group by Source Security Zone and Destination Security Zone, or by Source Environment and Destination Environment. Traffic between zones that must remain separate appears as a link between those groups.

To display only this traffic, use a query such as:

Source Security Zone = "Guest" AND Destination Security Zone = "Cardholder Data"

Measure Traffic to Cloud Providers and Partners

Goal: Determine how much traffic is exchanged with each cloud provider or partner network identified by its AS number.

View the result: Group by Destination Cloud Provider to view traffic sent to each provider. Group by Source Cloud Provider to view traffic received from each provider.

Check DSCP Markings for Voice Traffic

Goal: Verify that traffic from IP phones contains the expected DSCP marking, such as EF (46).

View the result: Group by Source Application and dscp. Traffic from the Voice group that is not marked EF indicates where the QoS marking is missing.

Compare Traffic by Site Type

Goal: Compare traffic across different site types, for example, before deploying a new service to all stores.

View the result: Group by Source Site Type to compare the traffic sent by each type of site.

When Changes Take Effect

The NPM Collector applies groups to traffic as the traffic is received. The collector loads the grouping configuration from OpsRamp when it starts and refreshes the configuration once every 24 hours by default.

• After you create, edit, or remove a group or criterion, allow up to 24 hours for the change to appear in NetFlow data.
• Grouping applies only to traffic received after the collector loads the change. Previously received traffic retains the group labels assigned when the traffic was received and is not relabeled.
• If you rename a group, traffic received before the change retains the previous group name. If the selected time range spans the change, both the previous and new group names can appear in the results.
• If you remove a group, traffic received before the change continues to display that group.

Troubleshooting

Related Topics

• Network Performance Management
• Netflows Configurations
• NPM FAQs
• NetFlows Tile
• Netflow Insights
• NPM Collector