We see a Flow Direction in the Flow Navigator on the web server (Egress in the example above) and the arrow that could be assumed as the direction for the port, but no PortDirection field anywhere on the web server or on Orion SWQL SchemaĪ search on Thwack for PortDirection does not return any result (the SQL results below have been extracted from querying 圜onversation using the Orion SDK PowerShell plugin)įor the Port you wrote: In the mentioned entities is field PortDirection which distinguish the direction for the port However, depending on the ingress or egress value being 0 or different than 0, your web server reports a conversation as being from the DestinationHostName instead of matching the flow of the conversation being reported (Source -> Destination) When using 圜onversations we are presented with a SourceHostName and a DestinationHostName. Thanks for the clarification on the IP used in the conversation filtering. In the mentioned entities is field PortDirection which distinguish the direction for the port. Its more complex, but usually it select port with lower number as we don't want to store random high ports. The NTA has mechanism which selects the 'interesting' port that will get stored.

The NTA is storing only single port for the traffic, so getting source and destination port together for the conversation is not possible.

The difference between them is that FlowsB圜onversation is sorting IP addresses based on their numerical value (CASE WHEN SourceIP < DestinationationIP THEN SourceIP ELSE DestinationIP END AS SourceIPAddress). I would recommend using or 圜onversation which are designed to be used for reporting. I wouldn't recommend using the ConversationsDetailReport entity as it is used for the specific resources.

Orion netflow