There is a list of common application ports that make up the "monitored" traffic. All the other ports are considered "Unmonitored". In 3.5 you have the option to see how much of your traffic is considered unmonitored and some options to manage it. To see what the traffic is you can drill down into it on the NTA views and see if any of it is traffic you care about. If it is not go to NetFlow Settings (upper right of NetFlow Summary page) and un-check the option to retain data for unmonitored ports. I'm using a development version so the interface I'm looking at is not exactly like the 3.5 one, that is why I'm not giving you the exact verbiage you will see on the screen.
There is another option in the NetFlow Settings area to see the ports you are monitoring and add ones that are not presently monitored. You can also add all the ports but this might result in flooding the traffic of interest with traffic on dynamic ports.
Hope this helps - Andy
Makes perfect sense now. I just wasn't used to seeing this new data.
I am new to NTA. I just installed it. I am seeing about 40% unmonitored traffic. Here are a few items of note:
1. Unizensus Login Server - port 1151
2. fjdocdist - port 1848
Can I ignore these or should I further investigate on them?