Top Applications

This workspace report displays the applications used by devices generating the most traffic traveling in the selected direction (Inbound, Outbound, Inbound and Outbound, or Bounce) on the selected interface. Applications correspond to ports that are used by IP protocols (80:http, 110:pop3, 443:https, etc.). By default, NetFlow Monitor monitors ports below 1023, and a few higher numbered ports. You can configure monitored ports on the NetFlow Ports dialog.

Application data is useful in determining the types of tasks persons on the network are conducting the most over the selected time period. For example, pop3 indicates a person is checking email, while http signifies other Web-based tasks.

Port-specific application traffic is reported in bytes and as a percentage of the top x results from the current interface for the selected time period.

Note: Traffic that flows between unmonitored ports is considered unclassified. In NetFlow Monitor, for traffic to be considered "unclassified," both the port from which the data is sent, and the receiving port must not be classified in the NetFlow Ports dialog. If either the sending or receiving port is classified, the traffic is associated with the application of the classified port.

If NetFlow Monitor detects a large amount of traffic to an unmonitored port, this workspace report displays a yellow warning flag that explains the situation and guides you in defining the unmonitored port. This can help you to proactively detect emerging non-standard traffic on your network. You can also use the Unclassified Traffic dialog (available from any page in NetFlow Monitor by selecting GO > Configure > NetFlow Unclassified Traffic) to view all unclassified traffic since the last hourly rollup.

For more information

About interface traffic directions

Configuring this workspace report in NetFlow Monitor

Exporting data from this workspace report

About workspace reports and filters