Monitoring Network Traffic

Who Are the Top 5 Talkers?

The colors are in the same order as they appear in the legend, that is, the node with the greatest activity is represented by the color at the bottom of the stacked bar. The white portion of the stacked bar represents the top talkers in minutes who are not top talkers in the selected minute; the dark gray portion of the stacked bar represents all other activity. You can visually trace the same color across the graph to see trends of activity over the past hour.

Information for the top five colors in the legend identifies the source and destination nodes of the top five connections for every data point on the graph. The information in the color legend will change as the data points are graphed. Depending on the parameters you have selected, the information provided by the legend can include:

■The layer 3 or layer 2 (MAC) address

■The network protocol or service being used. The highest network protocol for the communication path is displayed.

■The direction of data flow (the source and destination nodes)Here is an example of information that you might see in the legend:ETHER 00:00:10:44:36:12 (DOD IP)

The first item displayed (ETHER) is the highest (in the network stack) decoded network protocol used for this destination. The number to the right (00:00:10:44:36:12) is the IP address of the destination. The last item displayed in parentheses (DOD IP) is the network service this source node is using to communicate in this network connection. If the network service is a well- known service such as telnet or ftp, then the service name appears inside the parentheses. If the network service is not well-known, then its socket number is displayed in the parentheses.

Other Top Talkers Not in Selected Minute

You may get more information from the Top5 View by clicking on a stacked bar that contains a white stack. The white stack represents the top talkers that occurred in a minute other than the selected minute. For example, if the selected minute is 2:01, but you notice that there is a tall bar with a large white portion that occurred at 1:30, you can click on the 1:30 bar to see who the top talkers were during that minute. The stacked bar and the legend change to represent the top talkers that occurred at 1:30.

N o t e

If your graph is displaying stacked bars with large portions of white, it is

 

possible that the selected minute is not displaying the most active nodes.

 

 

9-9