01-04-2022 02:10 AM
Hi !
we have a query in Netflows. we have configured Netflows on PA820 firewall and enabled monitoring on both WAN and LAN ports. The flows are going to the Netflow collector and everything working as expected. when we are analyzing the Netflows we are struggling to understand the who is the originator of the Flow, especially with UDP high ports. is there any way to find the originator of the flow ?
For Example:
WAN port reports two kind of flows one is the reply packet to the flow initiated from LAN and Request packet initiated from WAN to LAN (DNAT scenrio). when we compare these two flows in the PCAP files, we can not identify which one is originated from which Zone. so far we identified using the TCP/UDP well known ports to identify the originator but if the flow got TCP/UDP high ports that is where we are struggling.
Please let me know if any one has any trick to solve my problem.
Thanks,
Tulasidhar
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
