Report Destination port diferent

[SOC_CSG]

Hi,

I have a doubt about this inform. I dont know why in my report depending on the source the detination port appears in the right column or not.

All those connections in this screeshot are in the port 161(SNMP) but only appears if the source ip is 172.16.29.151. If the souce ip 172.16.29.132 appears 0 in port destination,why??????? it should be appear 161 too??? the security rule is the same for both ip...

Thanks.

[nchong]

You will see port 0 if the protocol has no concept of port number. For example with ICMP.

You can compare the traffic/threat logs and check kind of traffic triggered this threat.