MS Exchange Netflow Information?

I just set ours to monitor all ports. I no longer have unmonitored traffic anymore

How do you setup NTA to monitor exchange?  What ports are used by Exchange and the clients?  Does 2007 use different ports than 2003?

Thanks, 

But even if I do that it still doesn't show up labeled as Exchange date, it just says Port 3459 or whatever, that's not very helpful if you want to gather cumulative number on Exchange traffic.

You can change the description of any port in the NetFlow Settings.

Login as an administrator on the web console.

Click on Admin > NTA Settings.

Edit the Application and Service Ports.

Type 3459 in the search bar.

Edit the port and modify the description.

If you wish to see NTA grouping the Exchange Traffic in a single application.

Click on Add Application and specify all the ports used by Exchange. Correct the duplicates if the port is already used by another application.

HTH,

Yann

That's the whole point, Exchange uses RANDOM ports to speak to Outlook.  You can't label them ahead of time because you never know what they are going to be.

It would be a tremendous feature within NTA if you could classify traffic based on IP Address too.  That way one could have traffic going to a particular server labeled a certain way regardless of what port is used.  Seriously, Exchange is a major player in my network and since it shows up as Unmonitored data, NTA is losing its value.

Dear Seinfeld fan - ;)

This is a feature enhancement I have documented. No release date to give out yet but I agree with you that this is a must.

Andy

Then why not build and IP address group of your Exchange servers and call it a day? As you have stated the ports are RANDOM, which means - lacking any definite plan or order or purpose; governed by or depending on chance - how exactly would you expect anything to track that based on ports?

You would basically have to assume that any traffic you saw going to or from the Exchange boxes was related to mail.

IP Address group?  What do you mean by this?  Is this a new NTA feature?  You've hit at the heart of this issue, the only way to track this is based on IP address.  I'm saying it would be nice to be able to define an overriding classification rule within the NTA to tag traffic going to a specific IP address as "Exchange" or whatever app is using random ports, thus making it easier to classify all of your network traffic.

IP Address Groups have been available since NTA 1.0.  Go into NTA settings and you can define them.