Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Reporting RDP Sessions

Is it possible to query on RDP/SSH sessions over the network using MARS if netflow is enabled?

1 REPLY
New Member

Re: Reporting RDP Sessions

I suppose that would only be possible to a certain limit. You can find out e.g. using " Activity: All Events and Netflow - Top Destination Ports "

report as to how much of traffic was utilized for RDP, but to get actual and true picture of netflow, you cannot use MARS, as it does not report the conversations, rather it uses netflow to detect any anomolies ONLY from logging the traffic and detecting sources and destination IP addresses. It doesn't really coorelate the data received through netflow.

regards,

Mohsin

172
Views
0
Helpful
1
Replies