We use Commvault for backups. One main port it uses is 8605 which I have defined. It also uses a bunch of high random ports, so when looking at our Top Applications the unmonitored is always in the top 3. I created an IP address group to include only the IP addresses of our backup servers, but that only helps when looking at the IP address group graphs/reports. Is there anyway to do this so Top applications unmonitored is not so big?
I have done some searching and no luck so far. This isn't traffic from unmonitored devices, but more like unknown data/ports from monitored devices.
Along with creating the IP address group, also in Netflow settings --> Applications and Service Ports I created an app called Commvault. I have it set to port 8605 since I can't leave it empty. Also set the Source and Destination to my IP address Group. Should I set the port range from 0 - 65535? If that will only monitor those ports between those IPs then that might work, but I don't want to do this if it is going to monitor all ports between all my netflow devices and cause my DB to grow insanely.
Thanks