I am hoping for a little help either understanding or refining my use of NetFlow Analyzer.

 

We currrently use a small Cisco 800 series router for NetFlow analysis, so the setup of the network looks like:

 

NetFlow Analyzer Server <--> LAN <--> Cisco 870 <--> Pix <--> Internet Router

 

This seems like a normal setup for our specific analysis, as the Cisco router captures traffic on its internal interface (termed Vlan1) as well as its external interface.  Ideally, I feel like this should let us have a rather granular view of where traffic originates internally, i.e. which host is using bandwidth at a given time.

 

My puzzle, though, is that the reports aren't giving that particular information, or at least aren't providing information that makes sense to me.

 

For instance, on the router's internal interface for a 6-hour period yesterday, I show the following figures:

 

Source, In: 84.38 MB total

Source, Out: 641.08 MB total

 

Destination, In: 84.38 MB total
Destination, Out: 641.08 MB total

What I'd like to determine is what internal host(s) are using so much of the bandwidth.  So, in looking at the Source, Out report, I see an Akamai server with 179.18 MB of traffic.  It seems like this ought to somehow match to an internal host, but looking at the Destination, Out report, I show the router's *external* interface as consuming 640 MB of bandwidth (whereas I expected an *internal* client to be indicated.)

 

I don't know if I'm simply reading the reports wrong, or if I'm asking the wrong question.  What I do know is that I cannot seem to isolate an internal host for this traffic.

 

Any thoughts, suggestions, ideas, or harsh criticisms?