Top Receivers with the Most Failed Connections
Top Receivers with the Most Failed Connections report reveals devices that received the highest number of unsuccessful TCP connection attempts, or SYN packets.
Unsuccessful connections (incomplete TCP handshakes) can imply port scanning, penetration testing, and methods used by security testers or hackers to find potential intrusion points on a network. Large numbers of these half-open or incomplete connections can also denote an attempt at a denial of service (DoS) attack.
- . Host name of the top receiver with the most failed connections.
- . Field composed of top combined with, State, and Country identifiers included.
- . Top receiver's city.
- . Number of failed connection attempts.
- . Total average packet rate.
- . Percentage of top n items ranked.
Several report columns do not appear by default and can be configured to display in this report. You can display the following additional report columns:
- . Receiver's IP address.
- . Receiver's hostname.
- . Subdivision for the current city.
- . Country for the current city.
- . Degrees latitude associated with the current city.
- . Degrees longitude associated with the current city.
: To show reports in full screen with most if not all possible columns, click on report options (
) menu and choose (
).
Generate a report
. 
, 
Choose a networking device or single physical or virtual interface you want to see Top Receivers with the Most Failed Connections measurements for. Choose traffic direction across an interface.
Use the Select Device dialog for one of the following:
Control
|
Description
|
Device.
|
Browse and choose a networking device that is a Network Traffic Analyzer monitoring source. (For example, wireless router, router, and more)
|
Network Interface.
|
- Choose a single physical or virtual interface Network Traffic Analyzer you want traffic statistics for.
- Choose direction of traffic over the network interface (, , , or for invalid traffic.).
|
Network. 
|
Network devices known to NTA.
|
. 
Choose times for the Top Receivers with the Most Failed Connections. (Subject to NTA collection interval and retention policies.)
Choose time constraints for your NTA data view
Date Range . Choose or define an overall window of time network activity data.
: Detail rendered in graphs depends on the time window you choose (Date Range) along with how long your system retains raw, hourly, and daily time-series data (NTA data collection and Data Retention settings). NTA graphs network activity as time-series averaged over daily intervals, hourly intervals, or over shorter periods (raw). Raw data interval is defined by the data collection interval in NTA settings.
: If you choose a time window outside of your NTA default data retention limits (8 hours for Raw and 10 days for Hourly, for example) your graph will default to an interval detail of Daily.
Detail Revealed with Default Retention Settings
Over time, the NTA collector cleans up older data. Eventually, collected data is combined into daily totals at the rates shown in the following table. If your site's mission and database capacity allow for more detailed data be retained for longer periods, increase the default retention settings in the NTA Settings dialog ( menu ).
Report Time Window Selection
|
Data Interval Shown in Graph (default retention settings)
|
Example
|
0 – 7 hours
|
Raw
- Data interval = every two minutes.
- Default data retention = 7 hours plus the current fraction of an hour (unless extended in NTA Settings).
|
Top Applications observed over the last 30 minutes (raw)
|
more than 8 hours within the past 9 days
|
Hourly
- Data interval = every hour.
- Default data retention = 9 days plus the current fraction of a day (unless extended in NTA Settings).
|
Top Senders over the last day (hourly)
|
10 days or more
|
Daily
Data interval = every 24 hours.
Daily is also the Archive data interval.
|
Top Protocols over the last 10 days (daily)
|
. 
Choose and hide columns, reorder columns, and apply advanced filters 
to customize your data view.
Filter and pick by column
Click a report heading () and use the "column picker" (
) from the drop down list.
Control
|
Purpose
|
Columns.
|
Click a check box to display the column. Clear the check box to hide it.
|
Move Column.
|
Click on a column heading and drag it to reorder your table's columns.
|
Advanced Filtering.
|
Apply category, pattern, and keyword filtering to column data.
|
. 
Apply chart, geo mapping (World Map), and display options in Report Settings dialog (optional).
Specify threshold and top n:
Control
|
Purpose
|
Show Top n Items
|
Limit items to the samples with the highest values.
|
Sort by Field
|
Select a column to sort by (if applicable).
|
Chart and view options
Control
|
Purpose
|
View Options
|
Select/clear the checkboxes to display/hide
- Totals. Display totals for each column.
- Others. Remainder values that do not make the top n.
- Chart. Display the selected Chart Type
- Legend. Include legend and grid lines for readability, show rotation angle of map, and more.
- Trend Lines. Present data a smoothed average to show trend.
|
Chart Type
|
Select a chart type and associated options:
- Pie. Pie distribution chart.
- Line/Area. Scatter graph that connects adjacent measurements with straight lines.
- Spline/Area Spline. Choose a graph with a smoothed appearance where adjacent samples exhibit a gradual slope.
- Vertical Bar/Horizontal Bar. Vertical or horizontal bar chart/histogram.
- World Map. Visualize your network traffic by location using a geographic map view within the report area. For information on World Map report navigation, please see Working with NTA reports using the world map.
|
Y-Axis Scale
|
Scale Y-axis (chart and graph height) automatically or choose a fixed size.
|
Export report data
Report data can be exported from WhatsUp Gold, reused, and distributed in multiple formats. Select () from the Dashboard Options (
) menu. After the report has been expanded, select the Export Data icon to access the following options:
- . Generate and download a .htm file presenting your report data as it appears in the WhatsUp Gold user interface.
- . Generate and download a .xml spreadsheet containing your report data.
- .Generate and download a .csv file containing your report data.
- Generate and download a .txt file containing your report data.
- . Set a recurring date and time, format, and email destination for report data export.
: Current report data file format options are only applicable to export schedules created using WhatsUp Gold version 2021 and later. Any report data export schedule created using an earlier version of WhatsUp Gold will still result in a .PDF output until that schedule is removed from, then recreated in the Scheduled Reports Library using the latest version of WhatsUp Gold.
Network Traffic
Choose source.