cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Community Manager
Community Manager

Monitoring Zoom Traffic with Network Traffic Analyzer (NTA)

With remote workers becoming more and more common, collaboration software is being leveraged by more organizations.  Monitoring Zoom traffic in your network can offer some insights into collaboration usage trends over time.

This the third article in our series describing how to craft custom applications in NTA.

Next Generation Network-Based Application Recognition Protocol (NBAR2)

If your networking infrastructure supports the NBAR2 protocol and you are running Protocol Pack 41.0.0 or later, then you are already seeing Zoom as its own application family.  It will appear (after being detected) as “zoom-meetings.”

If your network infrastructure doesn’t support NBAR2, you can still get the classification for Zoom communications.

Custom Application Build

A custom application to monitor Zoom requires two parts.  The first part is building a custom IP Group with the target addresses of the application.  Thankfully, Zoom is good about publishing the IP information.

Build the IP Group

From the NetFlow settings page, scroll down to IP Address Groups.

KMSigma_0-1584637448436.png

 

Build a new group and add the addresses.

KMSigma_1-1584637448460.png

 

These are rarely small lists, so we’ve expedited the process by providing a file you can import.

KMSigma_2-1584637448467.png

 

If you choose to import it, be sure to “append” to the existing list of IPs.

Build the Multi-Port Application

The last step for building the custom application is configuring the ports for traffic matching.  From the NetFlow settings page, select “Application and Service Ports.”

Click “Add Application” and give it a name, enter “80, 443, 3478-3479, 8801-8810” in the port list, and select Zoom in the Destination IP Address.

KMSigma_3-1584637448476.png

 

Submit all your changes.

Now the new custom application will show up in your Flow Navigator.

 

 

"Shoot for the stars to reach the moon"
2 Replies
Highlighted
Level 13

Re: Monitoring Zoom Traffic with Network Traffic Analyzer (NTA)

Woah! That is a monster list. Thanks for making the list importable, and save us from typing all those

Community Manager
Community Manager

Re: Monitoring Zoom Traffic with Network Traffic Analyzer (NTA)

You are most welcome.  It should remain accurate for a few months (at least) and then minor changes should be possible without too much headache.  Glad that you'll get use out of it.  That's why we're here.

"Shoot for the stars to reach the moon"