Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

A lot of Quicktime traffic - bug in Netflow settings

Hi,

I just installed Netflow on our existing NPM SLX server and after a while I saw a lot of Quicktime traffic on our Netflow-enabled Routers....

It did not seem right, so I started to investigate and here is what I found:

In the webinterface, Netflow settings, Application and Service ports setting: Edit Quicktime and change the range from 6970-9999 (default) to: 6970-6999 (right setting).

Now the Quicktime traffic is more normal on the Routers :-)

Nice that I saw this bug before I killed some of the users for using Quicktime in the working-hours... ;-)

Find more posts tagged with

Accepted answers

All comments

mcbridea

Various applications use ports 6970 - 6999 but this range is most often referred to as Quicktime. 6970-6999 or a subset of those ports is often used for BitTorrent. It's just an inherent limitation of an analysis that is port based. NBAR was created to solve problems like this.

paja.one

Thanks for a good suggestion, apple site says the same (http://www.apple.com/quicktime/resources/qt/us/proxy/).

kiwi

Hello

is NBAR information used by Orion NetFlow ? where can we see that ? assumin that my Router has NBAR enabled in addition to NetFlow. I tried ManageEngine NetFlow and it has the option to enable NBAR if the user wants.

Thanks

mcbridea

It is not in the product today but is on the roadmap

kiwi

Thanks mcbridea for your reply.

I posted ,

Tracking user level NetFlow traffic, any hint please ?