IsarFlow allows the grouping of interfaces or IP addresses across different routers. This enables the representation of locations - regardless if the location is connected through one, two or more interfaces.

The complete traffic on all interfaces or IP addresses that belong to a location is captured through the selection of this location in the drop down menu of views. Which interfaces/IP addresses belong to a view is displayed in the title.

By using these logical views on your network, real traffic matrices can be created which - next to the accounting analyses - offer a quick overview over the traffic relations. The IP views strengthen the independence from the physical infrastructure and thereby allow logical layers to be included in the analyses.

In addition, IsarFlow offers the possibility to define applications as a combination of IP protocols and IP addresses.

Thus, you can include applications in your analyses which are very difficult to capture otherwise, i.e.:

• application server(s) changing ports are easily tracked by IP address
• applications providing a web portal are seperated from other HTTP traffic by IP address

Furthermore, it is possible to aggregate several protocols to an application group. Infrastructure traffic for instance, is a composite of SNMP, ICMP, DNS, network control messages and many other protocols. Proper arrangement increases clarity and lowers administrative effort, but also requires less specific knowledge about protocolls.

The image on the right shows evaluation of the data from above by means of application groups. IsarFlow ships preconfigured with customizable default groups.