I great feature which I believe would increase the functionality/usability on NTA IP Groups is by allow you to optionally select flow source interfaces. Here are what I think would be the gains won by adding this feature:
- Faster NTA Processing: likely significantly lower load on NTA processes and servers by reducing the data to be parsed per IP group.
- More Accurate Reports: increase the accuracy of NetFLOW IP group reports. Flow collection often happens at multiple points in a network. This means SW NTA numbers are often inaccurate in deployments where IP Groups are used for analysis, because of double-, tripple, or worst accounting of the same flow throughout the network
- Large Multi-Site, Multi-Customer Scalability: Unfortunately, it is not uncommon to have multiple sites or customers use the same private IP ranges. This issue kills the ability to uses IP groups to manage these overlapping ranges. By segregating overlapping spaces by flow source interfaces, we can have those default 192.168.x.x or 10.x.x.x on multiple sites and not worry about IP group accuracy.