Submit a ticketCall us

Systems Monitoring for Dummies
Our new eBook will teach you the fundamentals and help you create monitors and alerts that are effective, meaningful, and actionable. Monitoring is more than a checkbox on your to-do list. This free eBook will give you practical advice to help you succeed in all aspects of monitoring – discovery, alerting, remediation, and troubleshooting. Don’t miss out on this indispensable resource for newbies, experienced IT pros, and everyone in between. Register Now.

Home > Success Center > Netflow Traffic Analyzer (NTA) > Application charts showing unmonitored multi-port traffic in Netflow

Application charts showing unmonitored multi-port traffic in Netflow

Updated August 8th, 2016


Netflow charts for application show a large amount of traffic for unmonitored multiport applications.


All NTA versions


The ports that the unmonotored application traffic is using has not been mapped in Solarwinds. When Solarwinds recieved a flow from a device, Solarwinds only looks at the port number. It will then compares that port number to what application uses that port.


For example, an application call MyEmailApp that uses ports 12345 - 12350 that SolarWinds sees as unmonitored traffic. Then lets say there is a user (workstation) that is sending data through your router to some external service, an email application called MyEmailApp, using port 12346. If the port to Application mapping doesn't exist in Solarwinds then Solarwinds will always show that traffic as unmonitored because it doesn't know that port 12346 = MyEmailApp.

If you go into Settings > NTA Settings > Application and Service Ports, you can see what application has been mapped to what  port(s).

Understand also that not all traffic can or will be identified to a certain ports. Certain application cannot be map at all simply because there are so many application that can or could be used by a user and there are certain applications (Skype for example) that uses different destination ports every time its brought up, therefore making it impossible to map.


Create a port to application map

  1. Go to Settings > NTA Settings > Application and Service Ports.
  2. Click on Add Application.
  3. Fill in the description, port number(s), source IP address, destination IP address, and protocol.
  4. Click Add Application.

NOTE: Using the example above, adding MyEmailApp as using ports 12345 - 12350, leaving the rest of the fields at the default, will now make it so that charts will show traffic statistics specifically for MyEmailApp as opposed to Solarwinds taking that traffic and grouping it into unmonitored traffic pile.



Last modified