Hello. I need to determine who is using pptp and would like to do this by running a MARS query. What's the best way to set up a query to detemrine this? I didn't see GRE listed in the MARS services but I did see ms-pptp (basically dst port 1723). Is there a way to run a query on GRE use? Also, should I rank by source IP or do all matching sessions? Any help would be appreciated.
Christine
