Patrick,

What I did to try and sort out the "Other traffic" was to use "show tfo conn summary". That shows all the current connections and which ports are being used.

Then you need to look at the classifiers and maps (which I got from show run) to figure out which traffic matches with which classifier. Whatever is left is the "other" traffic.

The big problem is that what you are looking at with show tfo conn summary is "live", and the graph you are looking at is historical. In order to sort out the traffic you may need to go through this process a number of times. Once you have figured out which ports or hosts are big contributors to your "other" traffic you can create new "applications" and "classifiers" and then tick the box to graph them.

It is a whole lot of work and may not give you any real gain. In my case we figured out what half of the "other" traffic was.

Hope this helps,

Peter