Unmonitored Traffic

jwilder

we recentely reinstalled NPM 9.5 and NTA 3.5 sp2 and started a new data store (our old one was corrupted). Since reinstalling i am now seeing a VERY large amount of data listed as "Unmonitored Traffic" we did not see this prior to the new install. Can someone explain what this is and what if anything i can do to correct it? It appears that we are missing a large amount of data monitored traffic. If this is the case then i need to get it resolved right away.

Thanks!

mcbridea

There is a list of common application ports that make up the "monitored" traffic. All the other ports are considered "Unmonitored". In 3.5 you have the option to see how much of your traffic is considered unmonitored and some options to manage it. To see what the traffic is you can drill down into it on the NTA views and see if any of it is traffic you care about. If it is not go to NetFlow Settings (upper right of NetFlow Summary page) and un-check the option to retain data for unmonitored ports.  I'm using a development version so the interface I'm looking at is not exactly like the 3.5 one, that is why I'm not giving you the exact verbiage you will see on the screen.

There is another option in the NetFlow Settings area to see the ports you are monitoring and add ones that are not presently monitored. You can also add all the ports but this might result in flooding the traffic of interest with traffic on dynamic ports.

Hope this helps - Andy