0 Replies Latest reply on Oct 20, 2007 7:45 AM by paullaf

    Top 10 conversations are almost identical

      Hi everyone,

      I've run a netflow realtime report of the top 10 conversations happening on a particular interface. The result is strange. Of the top 10 conversations, I'm seeing only 3 combinations of source IP, source port, destination IP and destination port. I'll try to post the report below:

       

      ConversationSource IP AddressSource HostnameSource PortDestination IP AddressDestination HostnameDestination PortProtocolTotal TrafficTotal PacketsTraffic Percentage
      1100.85.8.11Microsoft-DS (445)100.85.1.20cft-0 (1761)TCP52.92 Mb3560115%
      2100.85.8.11Microsoft-DS (445)100.85.1.20cft-0 (1761)TCP47.87 Mb3220513%
      3100.85.8.11Microsoft-DS (445)100.85.1.20cft-0 (1761)TCP46.36 Mb3119013%
      4100.85.8.11Microsoft-DS (445)100.85.1.20cft-0 (1761)TCP40.39 Mb2716911%
      5100.85.25.11Microsoft-DS (445)100.85.1.20SwiftNet (1751)TCP30.02 Mb202058%
      6100.85.8.11Microsoft-DS (445)100.85.1.20cft-0 (1761)TCP29.64 Mb199608%
      7100.85.8.11Microsoft-DS (445)100.85.1.20cft-0 (1761)TCP28.30 Mb190358%
      8100.85.8.11Microsoft-DS (445)100.85.1.20cft-0 (1761)TCP26.83 Mb180708%
      9100.85.8.11Microsoft-DS (445)100.85.1.20cft-0 (1761)TCP26.62 Mb179067%
      10100.85.8.11Microsoft-DS (445)100.85.1.20cft-0 (1761)TCP26.58 Mb178827%

       

      Based on this, I felt that conversations 1-4 should be one conversation with the total traffic and packets added up. It would then account for a higher % of the traffic. Conversation 5 as it's listed in the report, should be a seperate conversation because the destination port is different. conversations 6-10 should be added together because it is the same communication.  Those last 4 together would be the new conversation #2 because conversation 5(as listed above) would be less megabyles than conversations 6-10 added together.

       Is my netflow calculating wrong or am I not getting something?

       Thanks,

       Paul