Paul Formation Lap
I am seeing a major chunk of the traffic categorized as Others under the conversation.  May I know why I am not seeing the actual IPs of source and destination?


Replies (1)

Hi Paul,

The Unaccounted/Others traffic reported by NetFlow Analyzer can be because of two reasons.

The traffic categorized as unaccounted in last hour reports is because the total traffic value is available up to the second and application, source or destination data is loaded once in 3 minutes in the database. This difference between these two is listed as unaccounted when considering last hour reports.

Also, NetFlow Analyzer stores two types of data, Raw data and Aggregated data. Raw data contains every flow received from every device and can be stored for upto 1 month and gives a complete port level information using the Forensic Report.

As far as the aggregated data is concerned, it stores the 'Top N' records (Configurable through Product Settings - Server Settings - Record Count) for Application and Conversation tables. So flows not coming under this 'Top N' will be dropped. This dropped traffic will be displayed as "Unaccounted" or Others in the Application and Conversation tables for reports greater than 2 hour.

Please visit the link given below to know more about the Data Storage pattern in NetFlow Analyzer:

We show the information on Top conversation using the Aggregated in NetFlow Analyzer UI.

By default, in the Conversation widget we only list the top 10 to 20 conversation under Device drill down or Interface drill down, please expand the widget using  on the top right of the widget to get the details.

Thanks & Regards,

Aravind Lenin
Technical Support Engg- Netflow Analyzer