Community Archive (Customer) asked a question.
NetFlow - Unknown Destination Ports Summary SQL
Hi All
Having worked with a client to setup netflow one of the things that we found was that identifying custom port usage was a bit hard via the gui.
I wrote the SQL query below that summarises Unique unknown ports and also orders them from the largest packet count to the lowest. This means it's easy to add applications which contribute the most to the unknown status.
USE NetFlow
SELECT DISTINCT nDstPortID as Port, SUM(nPackets) as PacketTotal, SUM(nFlows) as TotalFlows
FROM UnaccountedFlow
GROUP BY nDstPortID
ORDER BY PacketTotal DESC
Andrei
I had not but will know for the future :D
Andrei
There is a similar functionality in the Unclassified report, when you group by sender or receiver port. Have you seen it?
Claudio