Flow Unclassified Traffic

Use this dialog to view unclassified traffic by the interface over which the traffic is transmitted.

Note: The ports listed in this dialog have not been mapped to any application. The traffic displayed is the total in bytes for the period since the last hourly roll up time.

Note: In Flow Monitor, for traffic to be considered "unclassified," both the port from which the data is sent, or the source port, and the receiving, or destination port, must not be classified in the Flow Ports dialog. If either the source or destination port is classified, the traffic is associated with the application of the classified port.

The dialog displays unclassified traffic data in the following fields.

Source IP. The IP from which traffic originates.
Source Port. The port from which traffic originates.
Destination IP. The IP to which traffic is sent.
Dst. Port. The destination port, or port to which traffic is sent.
Protocol. The protocol used to send the traffic.
Traffic. The amount of traffic (in bytes) sent during the conversation between the source IP and the destination IP.

Manipulating dialog data

Use the list fields at the top of the dialog to manipulate the port data displayed in this dialog.

Select an Interface over which unclassified traffic is transmitting.
Select a Traffic direction (Inbound, Outbound, Inbound and Outbound, Bounce) in which the unclassified traffic is traveling.
Select a filter (Conversations; Source IP, Port; Source Port; Destination IP, Port; Destination Port) by which to group the unclassified traffic from the Group by field.

Monitoring ports

If you want to monitor (classify) a port responsible for a large volume of inbound or outbound traffic, select one of the following options:

To begin monitoring a source port, select a port from the list, then click Classify Src Port.
To begin monitoring a destination port, select a port from the list, then click Classify Dst Port.
Note: After you classify a new source or destination port, only the new traffic will display under the newly classified port(s). Any previously unclassified traffic will not be displayed under the newly classified port(s).