Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout

EARLY FIELD TRIAL Chapter 4
78 Sniffer Adaptive Application Analyzer
Doubled Counts for Packets with Same Source and Destination
Port
The Statistics panel's Port tab includes a Packets column tabulating
the number of packets seen with a particular port designation. When a
packet has the same source and destination port, it will be counted in
this column twice – once for the source port and once for the
destination port.
For example, a single packet with the source and destination port both
set to 137 (a NetBIOS port) would be counted twice in the Packets
column for the 137 port. This is the way that the IP Address, TCP/
UDP Port, and MAC Address columns are all displayed, because there
are two of each of these addresses per each applicable packet.
As shown in the figure below, you can create a custom tab that will
display a correct count of packets containing any or all of these index
types (IP Address, TCP/UDP Port, MAC Address) by adding columns for
both sides of the connection. This way, you can see the directionality of
the exchange broken out. For example, in this case, you could create a
custom tab that included:
Port A
Port B
Packets TX
Packets RX
Packets
Summary tab shows total of 111 packets
accepted, but Port tab shows 118 packets on
port 137 because of doubled counts for packets
with same source and destination ports.
Custom tab broken out for directionality shows
the true packet count – 59 packets with the
same source and destination port were counted
twice to arrive at the 118 total.
Figure 4-5. Interpreting Packets with the Same Source/Destination Port.