Distribution by hosts shows the contribution of top hosts (individual IP addresses) to the specified traffic. It presents the traffic activity for both internal and external IP addresses.
To view traffic distribution by hosts:
Choose a node type (Exporters, Traffic Patterns, Subnet Sets or Favorites) from the accordion in the Menu Panel
Select desired node from the Node Tree
Choose Host from the Tab panel
The number of top hosts is configurable. To change the number of top hosts showing in the chart and table, see Configuring TopN Rules.
The screenshot above indicates that on the St. Louis interface belonging to New York Core Router practically whole incoming traffic (98%) came from the source 172.16.6.86.
Besides that, it is notable that 172.16.237.2 had atypical outgoing behaviour between 11 and 13h.
Host is in its essence an IP address. Host can be employee computer and server. One employee can use multiple IP addresses, but also more employees can use the same IP address.
You can expect top talkers to be proxy servers within your company network, since they provide the access to the internet.
Also, since the number of hosts on the company level can be quite big, you can expect a considerable amount of traffic grouped as "others" entry because most of computers in your network will have very small amount of traffic in comparison to proxy servers.
