Office 365 preset definition

Details about Office 365 preset definition. Differences between profile and chapter definition. 

Product: Flowmon OS

Version: Any

Platform: Any

Why the chapters are defined by AS numbers and profiles by hostname/subnets?

The profile channels are defined by hostnames or subnets as it is the most precise way to identify Office 365 in the flow data.

If the Office 365 communication is identified by hostname, it is not easily possible to decide if it is incoming or outgoing communication (hostname might be present in the flow data in both directions of the communication). Because of that, AS numbers are used to divide the flow data into incoming/outgoing traffic (download/upload chapters). 

Chapter filters are the following:
Download chapter: "not dst AS in [...]"
Upload chapter: "not src AS in [...]"

The filters are only excluding some known ASes (Microsoft, Akamai,...) as a source or destination. All standard end-customer traffic should match one of the filters so no traffic is missed.
The only traffic that could be completely missed in download/upload chapters would be transit traffic between those ASes. But transit traffic should not appear in the standard company network (it may appear in IXPs networks) and even if there is some transit traffic then it does not make sense to mark it as download or upload. It is not either of them.