Distribution by hosts shows the contribution of top hosts (individual IP addresses) to the specified traffic. It presents the traffic activity for both internal and external IP addresses.

To view traffic distribution by hosts:

  1. Choose a section (Exporters, Traffic Patterns or End Users) in the the Menu Panel
  2. Select desired node in the Node Tree
  3. Choose Host in the Tab panel



NetVizura NetFlow Analyzer - Distribution by Hosts

The number of top hosts is configurable. To change the number of top hosts showing in the chart and table, see TopN Settings.

In order to enable IP address resolution, your NetVizura server should have local or remote communication with DNS server (for Hostname) and Internet access (for Whois information).


The screenshot above indicates that over 90% of outgoing traffic came from first and third host in the table.

Besides that, if you move your mouse over some host, you can see Whois information that significantly saves time, improves readability of the statistics and increases overall contextual awareness.

For each host, DNS and WHOIS lookup are performed. IP is presented as Hostname, whereas WHOIS description is shown in a tooltip when specific conversation is hovered. Tooltip contains information about organization name, description, country, address, network range and more, depending on data availability.

  • Host is in its essence an IP address. Host can be employee computer and server. One employee can use multiple IP addresses, but also more employees can use the same IP address. 
  • You can expect top talkers to be proxy servers within your company network, since they provide the access to the internet.
  • Also, since the number of hosts on the company level can be quite big, you can expect a considerable amount of traffic grouped as "others" entry because most of computers in your network will have very small amount of traffic in comparison to proxy servers.



  • No labels