This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

What is Multi-Port Unmonitored Traffic?

byrona over 10 years ago

I am new to NTA so I am sure this is a stupid question...

I am trying to identify all of the traffic flowing to a specific destination IP. I have enabled all of the applications and service ports in NTA; however, I am still seeing a bunch of "Multi-Port Unmonitored Traffic", what is the cause of this and is there a way to figure out what it is?

Thanks in advance for any responses!

Top Replies

jswan over 10 years ago in reply to byrona +1

I don't have that specific problem (seeing multi-port unmonitored traffic) after enabling "monitor all ports", but even so, there's no way to use NTA to completely profile all traffic for a host that talks…

0 byrona over 10 years ago

Somebody... anybody? Could really use some explanation on this.
Cancel
Vote Up 0 Vote Down

Cancel
0 fosileyezed over 10 years ago in reply to byrona

This thread should help explain:
Cancel
Vote Up 0 Vote Down

Cancel
0 byrona over 10 years ago in reply to fosileyezed

Unfortunately this doesn’t explain it. The last person that responded on that thread indicated that they had done the same thing that I have done by enabling NTA to monitor all ports yet still receiving unmonitored traffic.
Thoughts?
Cancel
Vote Up 0 Vote Down

Cancel
0 jswan over 10 years ago in reply to byrona

I don't have that specific problem (seeing multi-port unmonitored traffic) after enabling "monitor all ports", but even so, there's no way to use NTA to completely profile all traffic for a host that talks on lots of different ports. This is because you can't get more than the top 100 results for any given NetFlow search, and because NTA rapidly summarizes data and drops the bottom 5% of flows in most configurations. This is supposedly going to be fixed in NTA 4, but until then you'd have to use another tool. Wireshark or Tshark can easily produce that data from a pcap. Bro Network Security Monitor is my personal favorite for that sort of thing.
Cancel
Vote Up +1 Vote Down

Cancel
0 byrona over 10 years ago in reply to jswan

Thanks for this info and the suggested tools, very helpful!
Cancel
Vote Up 0 Vote Down

Cancel
0 borgan over 10 years ago in reply to byrona

My understanding is that an "unmonitored port" is one that is not mapped to a named netflow application on the Applications and Service Ports page. You may have noted that one can always view the list of ports in the chart and then click the Monitor Port button to then create an application related to that port(s).
Does that help?
Cancel
Vote Up 0 Vote Down

Cancel