How does MARS calculate "bytes transmitted" for a session?

[tar_mynastyr]

Hi All

Recently I was playing with NetFlow and Query Result types and thought to myself: How does MARS calculate "bytes transmitted" for a session? As we know, MARS does not store NetFlow records into DB by default. So, does MARS maintain some other data structure, which is populated with "bytes transmitted" values taken from NetFlow events? Or maybe NetFlow events are not considered when evaluating a query with "bytes transmitted" result type, but rather some other event types are used instead?

Could anyone please shed some light on the topic? Thanks in advance!

[Farrukh Haroon]

This type of information is usually collected from firewall events (syslogs)

Alternateively the same can be done by adding the netflow samples report for the same session (tuple).

Regards

Farrukh