Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Proxy traffic incorrectly shown as random high port traffic

I have a proxy server which clients connect to on port 8080. It is the majority of traffic going to/from one site (confirmed by sniffer analysis).

Orion does not show port 8080 in the top applications view even when displaying 100+ entries on the chart.

I believe Orion is considering traffic to/from the proxy server as random high port traffic. Instead of showing TCP 8080, it is categorizing the source port (client traffic) by un-related application names.

So instead of 8080 being shown on the top applications view, I see numerous entries for fictitous applications that are not even running on the network.

Here is a snippet of the conversation history of one client talking to the proxy server:

10/16/2008 1:54:00 PM	TCP	impera (1710)	Random High Port	1.288 Kbytes	4 packets
10/16/2008 1:40:00 PM	TCP	rrilwm (1695)	Random High Port	131.088 Kbytes	118 packets
10/16/2008 1:40:00 PM	TCP	slingshot (1705)	Random High Port	2.656 Kbytes	10 packets
10/16/2008 1:39:00 PM	TCP	rrirtr (1693)	Random High Port	2.576 Kbytes	8 packets
10/16/2008 1:25:00 PM	TCP	microcom-sbp (1680)	Random High Port	108.662 Kbytes	100 packets
10/16/2008 1:24:00 PM	TCP	prolink (1678)	Random High Port	2.656 Kbytes	10 packets
10/16/2008 1:18:00 PM	TCP	ArborText License Manager (1557)	Random High Port	160 bytes	4 packets
10/16/2008 1:18:00 PM	TCP	tsspmap (1568)	Random High Port	160 bytes	4 packets
10/16/2008 1:12:00 PM	TCP	aspeclmd (1544)	Random High Port	2.656 Kbytes	10 packets
10/16/2008 1:12:00 PM	TCP	abbaccuray (1546)	Random High Port	2.656 Kbytes	10 packets
10/16/2008 1:12:00 PM	TCP	ArborText License Manager (1557)	Random High Port	79.406 Kbytes	70 packets
10/16/2008 1:12:00 PM	TCP	xingmpeg (1558)	Random High Port	2.576 Kbytes	8 packets

Is there a way to correct this?

P.S. - I have all ports enabled for monitoring. TCP 8080 was initially grouped in with one of the quicktime ranges but I created a separate entry called TCP - 8080 for it.

Find more posts tagged with

Accepted answers

All comments

mcbridea

Presently ports that are part of a group will not report outside of that group. So if 8080 is part of a group this is the cause.

deeze6

Hi Andy - thanks for the reply.

As stated in my post 8080 was originally part of the Quicktime group, so I specifically removed 8080 from the group and 8080 is on its own.

So I don't think that is the cause....

Any other ideas?

Presently ports that are part of a group will not report outside of that group. So if 8080 is part of a group this is the cause.

mcbridea

Well, you've got me on this one. I suggest support - they can fully investigate.

Andy

deeze6

Unfortunately I am still demo-ing the product so I can't open a support ticket...

Can anyone else help?

Thanks