Layer 4 server ports module

The Layer 4 server port statistics include traffic counters for each TCP and UDP server port on the network.

Web interface

The layer 4 server ports are seperated in a TCP and UDP tab. For each protocol a list with all seen server ports are shown. The statistics include the total amount of bytes and packets transfered to and from the specific server port as well as the current throughput. A history graph is available to show sent and received bytes and packets over time. As usual, the resolution can be changed using the top buttons to any interval. It is also possible to capture traffic for a specific TCP or UDP server port by clicking on the corresponding PCAP button in the last column. For TCP there is also a separate graph for TCP traffic that has not been accounted for any server port. This includes traffic to ports where there is no server running or the device did not see the connection establishment to determine the server.

Statistics for port

By clicking on a port the detail page will be displayed. The detail page shows an overview about traffic counters for that specific port as well as graphs for a view over time. On the bottom of the detail page there are tabs to choose between the list of IP addresses, layer 3 QoS and layer 2 QoS classes seen for that specific port.

IPs

In this tab there is a table listing all IP addresses that have been seen with the specific port as a server. The table contains the following information:

• The IPv4 or IPv6 address (linked to the respective Per IP statistics view of the IP module)
• Alternative names for the IP address like DNS name or DHCP names
• Number of total packets for that IP and port
• Number of total bytes for that IP and port (counting full ethernet frames)
• A button to trigger a packet capture including only traffic for that IP and port (see Capture module)
• A graph showing throughput history for that IP and port

When multiple pages of IPs are available, there will be a control field for switching table pages. The IP search bars allow for entering IP addresses or names to see only those element for which the entered string is part of the IP or dns/dhcp name. The table is sortable by most of the columns. IPs are linked to the respective Per IP statistics view of the IP module.

Layer 3 QoS

For layer 3 IP differentiated services codepoint (DSCP) are displayed in a table with traffic counters, a history graph of traffic over time and a PCAP button for that certain DSCP value. More information about QoS can be found in QoS module.

Layer 2 QoS

For layer 2 VLAN priority code points and MPLS traffic classes are analysed and displayed in a table with traffic counters, a history graph of traffic over time and a PCAP button that certain QoS tag. More information about QoS can be found in QoS module.