We just got our NTA and Netflow working and now I'm trying to sift through the data and get some meaningful information. As a starting point, I was looking at the Top Applications and saw some H.323 traffic. This particular segment of our network doesn't have any VTC or VoIP running on it, so now I'm curious to know where this H.323 traffic is coming from. Is there any way to drill down into that H.323 and see which endpoints are transmitting/receiving it?
we match applications based on used port(s), so it could have been potentialy also different traffic just using same port(s) (1720 in this case I guess). Anyway you should be able to click that line in a Application resource to drill down to Application view showing you detail info that need (endpoints etc.).