Kemp Support, how can we help?

The latest application delivery knowledge and expertise at your fingertips.

How to identify session originator in flow data

 

Information

 

Summary:

Identifying session originator in Monitoring Center - Analysis. 

Environment:

Product: Flowmon OS

Version: 12.x and lower

Platform: HW, Virtual

Question/Problem Description:

Each communication session is divided into two single flows. I want to identify which IP started the communication.

Steps to Reproduce:  
Error Message:  
Defect Number:  
Enhancement Number:  
Cause:  
Resolution: There are multiple options for how to achieve that:
  • Flow start time. A lower start time means that the source IP started the communication.
  • TCP flags - flags such as SYN or RST can guide you who started the session.
  • Port numbers - a port number higher than 1024 is usually a client which started the session.
  • Based on network knowledge you can use also other flow information such as VLANs, input/output interface, and direction (ingress/egress). 
Workaround:  
Notes: The direction field is available only in flow data created by routers/switches.

Was this article helpful?
0 out of 1 found this helpful

Comments