We need to have an API in NFA so we can determine when was the last flow sent to the Device. This way we know what device are no longer on the network and we can prune them out.
The 10.0 ODATA API looks promising: http:/127.0.0.1:8981/odata/api/interfaces?$select=RouterAddress,LastData though there seem to be default limits to only return 10 items per query. There is a $groupby option, but apparently no max function, yet.
select routeraddress,routername,from_unixtime(max lastdata)) from agents_all_view group by routeraddress;
might be a useful SQL query while ODATA evolves.
Right now we have a LastData field for the interfaces, but not the Routers themselves. It would be great if we could utilize the LastData field in the Routers table.