Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>I can see two basic ways of doing this...<br> 1. Group it all up, ignoring the a->b and b->a and then self join the results.<br> 2. Rearrange your data with the "lowest" ip address in the 'src' field, but also create a 'direction' field. </p> <p>Option 2 is probably the way I'd go...</p> <pre><code>SELECT SrcAddress, SrcPort, DestAddress, DestPort, SUM(AtoB) + SUM(BtoA), SUM(AtoB), SUM(BtoA) FROM ( SELECT CASE WHEN SrcAddress &lt; DestAddress THEN SrcAddress ELSE DestAddress END AS SrcAddress, CASE WHEN SrcAddress &lt; DestAddress THEN SrcPort ELSE DestPort END AS SrcPort, CASE WHEN SrcAddress &lt; DestAddress THEN DestAddress ELSE SrcAddress END AS DestAddress, CASE WHEN SrcAddress &lt; DestAddress THEN DestPort ELSE ScrPort END AS DestPort, CASE WHEN SrcAddress &lt; DestAddress THEN Bytes ELSE 0 END AS AtoB, CASE WHEN SrcAddress &lt; DestAddress THEN 0 ELSE Bytes END AS BtoA FROM PacketHeaders ) AS [data] GROUP BY SrcAddress, SrcPort, DestAddress, DestPort </code></pre> <p><strong>EDIT</strong></p> <p>A couple of other answers have version of what I called option 1. I'll have a go at it too rather than spamming comments on people's answers :(</p> <pre><code>SELECT ISNULL([AtoB].SrcAddress, [BtoA].DestAddress) ISNULL([AtoB].SrcPort, [BtoA].DestPort) ISNULL([AtoB].DestAddress, [BtoA].SrcAddress) ISNULL([AtoB].DestPort, [BtoA].SrcPort) ISNULL([AtoB].Bytes,0) + ISNULL([BtoA].Bytes,0), ISNULL([AtoB].Bytes,0), ISNULL([BtoA].Bytes,0) FROM ( SELECT SrcAddress, SrcPort, DestAddress, DestPort, SUM(Bytes) AS Bytes FROM PacketHeaders WHERE SrcAddress &lt;= DestAddress GROUP BY SrcAddress, SrcPort, DestAddress, DestPort ) AS [AtoB] FULL OUTER JOIN ( SELECT SrcAddress, SrcPort, DestAddress, DestPort, SUM(Bytes) AS Bytes FROM PacketHeaders WHERE SrcAddress &gt; DestAddress GROUP BY SrcAddress, SrcPort, DestAddress, DestPort ) AS [BtoA] ON [AtoB].SrcAddress = [BtoA].DestPort AND [AtoB].SrcPort = [BtoA].DestAddress AND [AtoB].DestAddress = [BtoA].SrcPort AND [AtoB].DestPort = [BtoA].SrcAddress </code></pre> <p>But I did say I wouldn't do it that way...</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload