Uncatagorized/Unknown Services and Ports Help!
I have an issue with protocols catagorized as Unassigned and are listed as unknown. There virtually no information that shows what those ports are outside of the home page and clicking the question mark to list them. The problem is that there is no way to actually tie a particular unknown protocol or port to a specific report with that list.
I am in the process of redesigning a firewall policy for 80 remote locations sharing one internet connection at one of the locations. I create a filter by network range to create seperate reports for each location. In the reports it states that there are a large number of transactions destined for the internet for Unassigned (which could be thousands of ports). Drilling further down and the only port that shows up is "unknown". This is a very big issue because unknown also could represent thousands of ports. Is there a way to show the actual ports in those reports so that we know what ports (deemed unknown) are doing what. The application is great for showing details on for optimizing the firewall policy or showing trends over a period of time but if most of the ports are set to unknown and the report shows unknown has x hits or whatnot it does not serve the purpose of the application very well. In it's current state, I cannot accurately develop a security policy for this organization without more details on what those ports are in those particular reports.
Also on the home page when you click on the ? next to unknown and it shows a list of ports it only goes back 6 hours. I need to same historical reporting on the unknown ports (with the port numbers shown) as I have with known and categorized ports.
Is there any way to disable all the categorization and just list the raw port/protocol numbers in the reporting.
I am in the process of redesigning a firewall policy for 80 remote locations sharing one internet connection at one of the locations. I create a filter by network range to create seperate reports for each location. In the reports it states that there are a large number of transactions destined for the internet for Unassigned (which could be thousands of ports). Drilling further down and the only port that shows up is "unknown". This is a very big issue because unknown also could represent thousands of ports. Is there a way to show the actual ports in those reports so that we know what ports (deemed unknown) are doing what. The application is great for showing details on for optimizing the firewall policy or showing trends over a period of time but if most of the ports are set to unknown and the report shows unknown has x hits or whatnot it does not serve the purpose of the application very well. In it's current state, I cannot accurately develop a security policy for this organization without more details on what those ports are in those particular reports.
Also on the home page when you click on the ? next to unknown and it shows a list of ports it only goes back 6 hours. I need to same historical reporting on the unknown ports (with the port numbers shown) as I have with known and categorized ports.
Is there any way to disable all the categorization and just list the raw port/protocol numbers in the reporting.