Top Ports Tab
- Click the Top Ports tab (or type Ctrl-2) to view a list of ports with the highest activity, with stack and pie charts showing the relative activity of each.
The Stack Chart
Use the Top Ports tab's Stack chart to view the relative activity of different ports over time. Each port's activity is stacked with the others, with the top port on the bottom of the graph. Here's a typical stack chart:
- Click a legend above the Stack chart to select the corresponding line in the Port list.
- Mouse over an area of the Stack chart to view port information for that activity.
- Click an area of the stack chart to select the corresponding line in the Port list.
- Click and drag to select a region of the chart to reset the time range to that area of the Stack chart.
- Click the Set Graph Scale button to set the vertical scale for the Stack chart. Choose Auto to normalize the scale to the displayed data, or select a scale between 1Kbits/second and 10GBytes/second.
- Right-click an area of the Stack chart and choose from the context menu as described below.
The Pie Chart
Use the Pie chart to view the relative activity of each top port in proportion to the others.
- Click a pie segment to select the corresponding line in the Ports list.
- Mouse over a pie segment to view the port corresponding to that segment.
- Double-click a segment of the pie chart to set a filter allowing you to view data only for the selected port.
- Right-click or Ctrl-click a point in the timeline and choose Center on This from the context menu to bring a particular point in the Stack chart to the center of the timeline.
- Double-click a pie segment, or right-click or Ctrl-click a segment and choose Select on Port/Protocol [Service or Port number] from the context menu to set a filter for that port.
- Right-click an area of the Stack chart and choose from the context menu as described below.
The Ports List
Use the Ports List to view detailed data about the top 25 ports.
- Click a column heading to sort by that column. Click again to reverse the sort.
- Click an unselected row to select it.
- Shift-click an unselected row to select all rows between that row and the currently selected row.
- Control-click a row to select or de-select it.
- Right-click or Ctrl-click a row and choose Select All to select all rows.
- Right-click a selected row and choose Copy Selected Rows to copy the currently selected set of rows to the clipboard in tab-delimited format.
Legend
|
Service
|
Protocol
|
Port
|
Bytes
|
%
|
|
HTTP
|
TCP
|
80
|
1.9MB
|
65.76
|
|
HTTPS
|
TCP
|
443
|
223.8KB
|
7.57
|
|
SNMP
|
UDP
|
161
|
134.8KB
|
4.56
|
|
POP3S
|
TCP
|
995
|
92.8KB
|
3.14
|
|
IMAPS
|
TCP
|
993
|
89.6KB
|
3.03
|
|
8181
|
TCP
|
8181
|
78.3KB
|
2.65
|
|
SMTP
|
TCP
|
25
|
74.0KB
|
2.50
|
|
465
|
TCP
|
465
|
72.2KB
|
2.44
|
|
DOMAIN
|
UDP
|
53
|
68.8KB
|
2.33
|
|
1278
|
UDP
|
1278
|
41.6KB
|
1.40
|
|
ICMP
|
ICMP
|
|
22.7KB
|
0.77
|
|
1220/TCP
|
TCP
|
1220
|
17.1KB
|
0.58
|
|
106/TCP
|
TCP
|
106
|
11.6KB
|
0.39
|
|
< up to 25 rows > |
|
|
|
|
|
OTHER
|
IP
|
|
13.4KB
|
0.45
|
- Legend - The top 10 ports are indicated with colored legends. The report shows the top 25 ports, but places the "Other" category at the bottom of the list, as it shows total traffic for the remaining ports not shown in the previous 24 rows.
- Service - Contains the name of the server associated with the port.
- Protocol - Contains the protocol (TCP/UDP/GRE/ICMP) associated with the port.
- Port - The port number
- Bytes - the volume of traffic (in bytes/kbytes/mbytes) for a particular
row in the specified time interval.
- % - the percentage of that traffic for the specified port in the specified time interval.
Context Menu - Top Ports tab
Right-click or CTRL-click (Mac) on the Stack chart, Pie chart, or Ports list, and choose from the Context menu as follows:
Stack chart:
- Select On [port] -include only traffic from the selected port.
- Exclude [port] - exclude traffic from the selected port.
- Center on this - centers the stack chart on the selected point in the timeline.
Pie chart:
- Select On [port] - include only traffic from the selected port.
- Exclude [port] - exclude traffic from the selected port.
Ports List:
- Select All - select all rows of the table
- Filter on selected port - include only traffic to or from the selected port
- Exclude selected port - exclude traffic from the selected row
- Copy selected rows - copy the fields from the selected table rows to the clipboard
- Copy IP address - copy only the IP address from the selected row to the clipboard
- Whois Lookup - see the Whois description for the selected port.