• State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 24 subscribers
  • Views 160 views
  • Users 0 members are here
Options
Related
This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Application Definition for Exchange

smartd

A large chunk of my traffic is uncategorized.  When I drill into it and look at the conversations most are talking to the exchange server.  I tried to build an application definition to identify this traffic.

I created an address group for all the IPs of the exchange servers

I created an application that uses ports 1025-49152 TCP, and has a source of exchange servers.  I couldn't figure out how to add a second rule to this application (like Oracle has), so I created a second application with the same name that has ports 1025-49152 TCP, and a destination of exchange servers.

This looks right, but the rule does not match any traffic. 

Suggestions?

-=Dan=-

  • 0

    Hello smartd,

     

    I am not hundred percent sure, but this seems to be “by design” of processing packets in order to identify related applications. Simply just one port from communication is preserved and its either the one (from source port and destination port) that is monitored or the smaller one if both are monitored. So in your case, there will be very probably smaller monitored ports on the other end of communication (smtp, http by owa or plenty others – http://msdn.microsoft.com/en-us/library/cc463889(v=EXCHG.80).aspx), which caused the ports on Exchange site to be zeroed in our data – so unluckily you cannot find these records by these ports any more.

    In case your exchange server(s) has dedicated IP and there is not any other online application running on this box, you would be probably able to see expected results by reviewing Conversations for specific endpoint (which is your exchange server box).

    Let us know if this does not help to handle your problem.

    Regards
    Jan

SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.

SolarWinds Customer Success Center Certification Media Vault Link Accounts
About THWACK Blogs For Government Edit Settings Free Tools & Trials
Legal Documents Terms of Use Privacy California Privacy Rights Security Information
©2024 SolarWinds Worldwide, LLC. All Rights Reserved.