How can I create a trend to focus on one MAC address?

  • 1
  • Question
  • Updated 8 years ago
  • Answered
Photo of Network Admin

Network Admin

  • 32 Posts
  • 1 Reply Like

Posted 8 years ago

  • 1
Photo of Aisling Brennan

Aisling Brennan, Official Rep

  • 389 Posts
  • 8 Reply Likes
The instructions to create a trend to focus on one MAC address:

Go to Plugins = > Trends = > Add Trend

= > Enter the following details

Title :: Description of Trend
Number of sets :: 1
Sensor :: 1
Subnet :: (leave blank)
Select Template :: Total Traffic

= > Click Save
= > Then change the following line

"query" => "Query ip sum(sent,rcvd) where {end#t##date}",

= > to

"query" => "Query ether sum(sent) where ( (edst=y) |
(esrc=z) ) & {timestamp#t##date}",

= > Click Save

This will create a trend for all traffic coming and going to this
MAC address .

Please contact support to receive values for 'y' and 'z' or follow the extra instructions below and for further help for creating a drill down for this trend contact support@netforttechnologies.com

Put the mac address in any of the LANGuardian MAC reports and run the report with qdebug=1, the value for edst will show up in the query.