12 Replies Latest reply on Oct 11, 2017 2:56 PM by billkoss

    "Random High Port"

      Is there a way to make the Neflow Traffic Analyzer show the actual port number when viewing conversations instead of "Random High Port"?  I need to be able to track exactly what port a conversation is coming from.   Thanks!

        • Re: "Random High Port"

          That feature is already planned for the next release of NTA and we're already working on it.



            • Re: "Random High Port"

              Is this 'feature' you mentioned supposed to be have been ready in NTA 3.5 or do you mean another release of NTA?

              The reason I ask is that my highest app usage still reports as RANDOM HIGH PORT 0 which is useless.

              1 of 1 people found this helpful
                • Re: "Random High Port"
                  Andy McBride

                  That feature was needed some more tuning so was not released in 3.5. We are still looking at the best way to accomplish this.

                    • Re: "Random High Port"

                      Thanks for the reply.


                      I've recently been tasked by my management to 'prove' this product (NTA) can provide reporting for our Internet Traffic (which supports users from multiple states) or else I am to find the product that can do our reporting. I feel this product might but I’m still not sure yet. It’s a little shaky making any Netflow report.

                      First - I need to know trending for our TOP TRAFFIC and secondly the TOP TALKERS then later we need a breakdown by state users.

                      Can you offer any help on this or maybe some tips? Especially using Report Writer with Netflow? So far, reporting is horrendously slow compared to what can be done with other reports outside Netflow data.

                      For instance I used the canned-report Top 50 Receivers - Last 24 Hours.OrionReport – I modified it for Top 25 and a made a filter for only a specific Ingress interface and then custom date for June 2009 and about fifteen minutes later got the report but afterwards I tried the other canned- report for Top 50 Transmitters, made my changes but this report never completes.

                      Its things like this with NTA which make me wonder if it is the right product for our needs.

                      • Re: "Random High Port"

                        This is something I'm looking to do as well. I would like to see the ports that are in use, and possibly edit/name what that port is assigned to. (eg: renaming the port to a specific client application)

                        Has this functionality been added with the SP1 release?



                          • Re: "Random High Port"

                            For performance reasons, flows are always assigned to one application.   Here is the algorithm we use to determine which port to keep:

                            1. Source and destination ports are both configured as monitored NTA applications - we keep the lower port, other is assigned as Random High

                            2. One port is configured as a monitored NTA app, the other port received in the flow is not - we keep the the monitored port and other is assigned as Random High

                            We realize this is not ideal and are working on fixing this. 



                    • Re: "Random High Port"

                      Hi is this feature working?

                      • Re: "Random High Port"

                        i'll +1 this.  Maybe a good idea to do so every decade until the feature is implemented.  No doubt it's going to be pretty kick @ss after nearly 10 years "working on it".