I wrote a SWQL query for some NTA data and included the port direction information. Every value in the report results is FALSE. What is the definition of port direction? See the attached screenshot of the report output. Thank you.
Furthermore, why is NTA assigning all of the traffic to port 65534?
Not sure about the Port Direction but for the port, can you check the settings in
(Settings > All Settings > NTA Settings > NetFlow Collector Services).
Settings > All Settings > NTA Settings > NetFlow Collector Services
And check the port being used there?
In things NTA related, port direction usually means inbound or outbound traffic on a given port. Usually with Netflow the best practice is to monitor all ports in the inbound direction, but not to do outbound traffic on any ports, otherwise you can get duplicated traffic.
However, that doesn't mean you can't do it, so I'm guessing this is monitoring which direction it goes. False/True probably relates to 0/1 in value, and I'm guessing 0 would be inbound?
