Hi all,
I have configured netflow v9 and try to use elk to monitor the upload and download bytes.
I tried to upload the file (4MB) from local (192.168.x.x ) to the ftp server (211.x.x.x),
log is like this
Conversely, I download the same file from ftp server to my local computer, the log is like this
The first question:
Is the number of field netflow.post_octet_delta_count be the transmission bytes of this file? If so, what is source.bytes and network bytes means?
The second question:
I mentioned that I do the upload and download action between these two ip 192.168.x.x and 211.x.x.x, but no matter upload or download, the source ip always be 192.168.x.x and destination ip always be 211.x.x.x, how can I distinguish the record is about upload or download? (Because I have to represent a graph of both)
Thanks for any advices.