1 Reply Latest reply on May 27, 2010 7:40 AM by Jan.Krivanek

    Application Definition for Exchange

    smartd

      A large chunk of my traffic is uncategorized.  When I drill into it and look at the conversations most are talking to the exchange server.  I tried to build an application definition to identify this traffic.

      I created an address group for all the IPs of the exchange servers

      I created an application that uses ports 1025-49152 TCP, and has a source of exchange servers.  I couldn't figure out how to add a second rule to this application (like Oracle has), so I created a second application with the same name that has ports 1025-49152 TCP, and a destination of exchange servers.

      This looks right, but the rule does not match any traffic. 

      Suggestions?

      -=Dan=-

        • Re: Application Definition for Exchange

          Hello smartd,

           

          I am not hundred percent sure, but this seems to be “by design” of processing packets in order to identify related applications. Simply just one port from communication is preserved and its either the one (from source port and destination port) that is monitored or the smaller one if both are monitored. So in your case, there will be very probably smaller monitored ports on the other end of communication (smtp, http by owa or plenty others – http://msdn.microsoft.com/en-us/library/cc463889(v=EXCHG.80).aspx), which caused the ports on Exchange site to be zeroed in our data – so unluckily you cannot find these records by these ports any more.

          In case your exchange server(s) has dedicated IP and there is not any other online application running on this box, you would be probably able to see expected results by reviewing Conversations for specific endpoint (which is your exchange server box).

          Let us know if this does not help to handle your problem.

          Regards
          Jan