{{indexmenu_n>4}}
====== Searching for subscriber IP address statistics ======
<note tip>
For this functionality, the following **components** are required:  
  - [[dpi:qoe_analytics:implementation_administration|QoE Stor module]]  
  - [[dpi:dpi_components:dpiui|SSG DPI management interface]]  
For this functionality, the following **licenses** are required:  
  - SSG: [[dpi:opt_cgnat|CG-NAT — network address translation and statistics export in IPFIX format]]  
  - QoE: [[dpi:licensing#qoe_licensing|NAT Flow statistics collection, compression, and custom filters.]]
</note>

Depending on the subscriber type, a different dataset is collected:
  * For a **public IP address**, it is sufficient to export Full NetFlow to QoE Stor — [[dpi:dpi_options:opt_statistics:statistics_ipfix|]].
  * For a **private IP address**, NAT Flow data about translations must also be collected — [[dpi:qoe_analytics:implementation_administration:configuration_setup:nat_flow]].

===== Data types =====
  * **Raw (unaggregated) logs** — contain the full set of IPFIX fields, including timestamps, IP addresses, ports, and more. These logs allow second-by-second analysis.  
  * **Aggregated logs** — summarized data used for reports such as Top Subscribers or Top Hosts. Aggregation groups events over time (for example, every 15 minutes) and omits unnecessary details such as ports, producing data suitable for interval-based analysis.  
Raw logs are used for detailed analysis, while aggregated logs are used for reporting.  
\\ \\

In this scenario, data lookup is based on aggregated data. Initially, SSG exports raw data to QoE Stor; by default, aggregation is performed every 15 minutes.  
See details on changing the aggregation and re-aggregation interval: [[dpi:dpi_components:dpiui:user_guide:admin_section:qoestor_man:fullflow_agg_change_step|]].

Raw unaggregated data is available in the following QoE Analytics GUI sections:
  - //Raw full NetFlow// (default data retention — **2 hours**)  
  - //Raw NAT Flow// (default data retention — **2 hours**), requires a QoE license  
{{:dpi:qoe:use_cases:ip_statistics:unaggregated.png?nolink&300|}}

Aggregated statistics are available in the following QoE Analytics GUI sections:
  - //NetFlow// (default data retention — **14 days**)  
  - //NAT Flow// (default data retention — **14 days**), requires a QoE license  
{{:dpi:qoe:use_cases:ip_statistics:aggregated.png?nolink&300|}}

===== Configuring data retention period =====
In the GUI: Administrator → GUI Configuration → Settings → QoE Stor → Database lifetime settings:
  * For Raw Full NetFlow: //QoE Stor fullflow main log lifetime (in hours)// **(1)**.  
  * For NAT Flow: //QoE Stor aggregated NAT log lifetime (in days)// **(2)**.  

{{:dpi:qoe:use_cases:ip_statistics:storage_setting.png?nolink&1200|}}

When increasing data retention, it is recommended to enable automatic deletion of old data when the disk is full:  
Administrator → GUI Configuration → Settings → QoE Stor → Disk Settings → Enable forced data relocation … → select //Enable data deletion!// → Relocation coefficient for DEFAULT disk … → set value //0.1//.

{{:dpi:qoe:use_cases:ip_statistics:data_deletion.png?nolink&1200|}}

You can check how much disk space logs occupy in QoE Analytics → Administrator → Reports → Table space information.

{{:dpi:qoe:use_cases:ip_statistics:info.png?nolink&1200|}}

===== Searching for subscriber activity in the SSG GUI =====

==== For a private IP address (NAT Flow section, QoE license required) ====
<note tip>You can request a license directly from the GUI in this section by filling out the form, or by emailing sd@vas.expert.</note>

Subscriber activity data becomes available after NAT log creation — see [[dpi:qoe_analytics:implementation_administration:configuration_setup:nat_flow]].  
In the GUI, go to QoE Analytics → NAT Flow.  
Then:
  - Select a time period  
  - Enable filters “Source IPv4 address” and “Destination IPv4 address” (check the boxes)  
  - Set filter values and apply changes  

{{:dpi:qoe:use_cases:ip_statistics:nat_flow_src_dest.png?nolink&1200|}}

==== For a public IP address (aggregated data, NetFlow section) ====
In the GUI, go to QoE Analytics → NetFlow.  
Then:
  - Select a period **(default retention is only 14 days!)**  
  - Enable filters “Subscriber”, “Login”, and “Host IP” (check the boxes)  
  - Set filter values and apply changes  

{{:dpi:qoe:use_cases:ip_statistics:aggregated_netflow.png?nolink&1200|}}

==== For a public IP address (raw full NetFlow section) ====
In the GUI, go to QoE Analytics → Raw Full NetFlow.  
Then:
  - Select a period **(default retention is only 2 hours!)**  
  - Enable filters “Source IPv4 address” and “Destination IPv4 address” (check the boxes)  
  - Set filter values and apply changes  

{{:dpi:qoe:use_cases:ip_statistics:fullflow.png?nolink&1200|}}