if you choose a port not to be monitored, that traffic would go to 'Unmonitored traffic'. You can drill down to that traffic to see which ports compose that category. This applies to Top Applications resource only, other resources display traffic regardless of port.
That helps, I'll have to wait until the next emergency (or try to simulate one) to verify. Just an odd question I guess, rather than trying to find what application is using the TOP bandwidth, I'm looking for something that will tell me EVERY device on the network is streaming from the same source. You'd think it would be the top endpoint. However, the WSUS server wasn't showing up there either. Things that make you go hmmmm....