Top Applications

This workspace report displays the applications used by devices generating the most traffic traveling in the selected direction (Inbound, Outbound, Inbound and Outbound, or Bounce) on the selected interface. Applications correspond to ports that are used by IP protocols (80:http, 110:pop3, 443:https, etc.). By default, Flow Monitor monitors ports below 1023, and a few higher numbered ports. You can configure monitored ports on the Flow Ports dialog.

Application data is useful in determining the types of tasks persons on the network are conducting the most over the selected time period. For example, pop3 indicates a person is checking email, while http signifies other Web-based tasks.

Port-specific application traffic is reported in bytes and as a percentage of the top x results from the current interface for the selected time period.

Note: Traffic that flows between unmonitored ports is considered unclassified. In Flow Monitor, for traffic to be considered "unclassified," both the port from which the data is sent, and the receiving port must not be classified in the Flow Ports dialog. If either the sending or receiving port is classified, the traffic is associated with the application of the classified port.

If Flow Monitor detects a large amount of traffic to an unmonitored port, this workspace report displays a yellow warning flag that explains the situation and guides you in defining the unmonitored port. This can help you to proactively detect emerging non-standard traffic on your network. You can also use the Unclassified Traffic dialog (available from any page in Flow Monitor by selecting GO > Configure > Flow Unclassified Traffic) to view all unclassified traffic since the last hourly rollup.

For more information

About interface traffic directions

Configuring this workspace report in Flow Monitor

Exporting data from this workspace report

About workspace reports and filters