Searching for subscriber IP address statistics

Searching for subscriber IP address statistics

For this functionality, the following components are required:

For this functionality, the following licenses are required:

Depending on the subscriber type, a different dataset is collected:

For a public IP address, it is sufficient to export Full NetFlow to QoE Stor — Configuring Full NetFlow Export in IPFIX Format.
For a private IP address, NAT Flow data about translations must also be collected — NAT Flow configuration.

Data types

Raw (unaggregated) logs — contain the full set of IPFIX fields, including timestamps, IP addresses, ports, and more. These logs allow second-by-second analysis.
Aggregated logs — summarized data used for reports such as Top Subscribers or Top Hosts. Aggregation groups events over time (for example, every 15 minutes) and omits unnecessary details such as ports, producing data suitable for interval-based analysis.

Raw logs are used for detailed analysis, while aggregated logs are used for reporting.

In this scenario, data lookup is based on aggregated data. Initially, SSG exports raw data to QoE Stor; by default, aggregation is performed every 15 minutes. See details on changing the aggregation and re-aggregation interval: Regregation of outdated aggregated fullflow logs.

Raw unaggregated data is available in the following QoE Analytics GUI sections:

Raw full NetFlow (default data retention — 2 hours)
Raw NAT Flow (default data retention — 2 hours), requires a QoE license

Aggregated statistics are available in the following QoE Analytics GUI sections:

NetFlow (default data retention — 14 days)
NAT Flow (default data retention — 14 days), requires a QoE license

Configuring data retention period

In the GUI: Administrator → GUI Configuration → Settings → QoE Stor → Database lifetime settings:

For Raw Full NetFlow: QoE Stor fullflow main log lifetime (in hours) (1).
For NAT Flow: QoE Stor aggregated NAT log lifetime (in days) (2).

When increasing data retention, it is recommended to enable automatic deletion of old data when the disk is full: Administrator → GUI Configuration → Settings → QoE Stor → Disk Settings → Enable forced data relocation … → select Enable data deletion! → Relocation coefficient for DEFAULT disk … → set value 0.1.

You can check how much disk space logs occupy in QoE Analytics → Administrator → Reports → Table space information.

Searching for subscriber activity in the SSG GUI

For a private IP address (NAT Flow section, QoE license required)

You can request a license directly from the GUI in this section by filling out the form, or by emailing sd@vas.expert.

Subscriber activity data becomes available after NAT log creation — see NAT Flow configuration. In the GUI, go to QoE Analytics → NAT Flow. Then:

Select a time period
Enable filters “Source IPv4 address” and “Destination IPv4 address” (check the boxes)
Set filter values and apply changes

For a public IP address (aggregated data, NetFlow section)

In the GUI, go to QoE Analytics → NetFlow. Then:

Select a period (default retention is only 14 days!)
Enable filters “Subscriber”, “Login”, and “Host IP” (check the boxes)
Set filter values and apply changes

For a public IP address (raw full NetFlow section)

In the GUI, go to QoE Analytics → Raw Full NetFlow. Then:

Select a period (default retention is only 2 hours!)
Enable filters “Source IPv4 address” and “Destination IPv4 address” (check the boxes)
Set filter values and apply changes

Table of Contents