The Unaccounted/Others traffic reported by NetFlow Analyzer can be because of two reasons.
traffic categorized as unaccounted in last hour reports is because the
total traffic value is available up to the second and application,
source or destination data is loaded once in 3 minutes in the database.
This difference between these two is listed as unaccounted when
considering last hour reports.
Also, NetFlow Analyzer stores two
types of data, Raw data and Aggregated data. Raw data contains every
flow received from every device and can be stored for upto 1 month and
gives a complete port level information using the Forensic Report.
As far as the aggregated
data is concerned, it stores the 'Top N' records (Configurable through
Product Settings - Server Settings - Record Count) for Application and
Conversation tables. So flows not coming under this 'Top N' will be
dropped. This dropped traffic will be displayed as "Unaccounted" or Others in the
Application and Conversation tables for reports greater than 2 hour.
We show the information on Top conversation using the Aggregated in NetFlow Analyzer UI.
By default, in the Conversation widget we only list the top 10 to 20 conversation under Device drill down or Interface drill down, please expand the widget using on the top right of the widget to get the details.