Let’s say that you are looking for information regarding network traffic taking place between company workstations and an application server; we’ll call it acmeapplication.com. You know that acmeapplication.com is using random port numbers to send downloads back to the workstations making the requests.

When using NetFlow analysis software to monitor network traffic, you may see lots of HTTP port 80 conversations with the assistance of the Conversations filter, but nothing showing the random ports used by acmeapplication.com, as demonstrated below.

However, if you change the filter to report on Connections for the same interface, you can see the source/destination ports used by both workstations and acmeapplication.com.

As shown below, Scrutinizer’s connection report summary will provide both the well known port and random port used during that conversation session to acmeapplication.com.

So if you are looking to expand on your network traffic monitoring and would like more information on customizing ports used by applications, check out Mike’s blog on How to Set up Application Groups.

- Scott -

Tags: application port, HTTP, NetFlow Analyzer, network traffic, port 80, Scrutinizer v7, well-known port

This entry was posted on Thursday, October 22nd, 2009 at 1:57 pm and is filed under NetFlow, NetFlow Analyzer, Scrutinizer. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.