Identifying the source of the flow data
The Flow Source and Flow Interface fields
on the Network Activity tab can help you identify which IBM
QRadar Network Insights appliance that the flow was
received from.
About this task
The Flow Source field shows the hostname of the managed host that received the flow.
The Flow Interface field shows the specific network interface that received the flows on the managed host. For standard network interfaces, the network interface name matches the names in the underlying Red Hat® Enterprise Linux® OS. For appliances with a Napatech card, the interface always appears as napatech0.
On the Network Activity tab, the flow source and flow interface appear in a single Flow Source/Interface field. In search results, the fields appear as two separate columns.
For example, the following image shows search results that include flows that are received from a
QRadar Network Insights managed host with a
hostname of shortblack. The flows are received from different network interfaces
on the single appliance.
Procedure
- Click the Network Activity tab.
- In the toolbar, click the pause button to stop streaming the incoming flows.
- Select the flow record that you want to view, and double-click to view the Flow
Information window. The Flow Source/Interface field is shown at the bottom of the window, in the Additional Information section.