1

I am exploring ntopng reports on my router and seeing, that one computer on my LAN is a flooder.

ntopng says Host XXX.XXX.XXX.XXX is a flooder [NNN new flows in the last 3 sec]

How to explore these flows in more detail to know if they are legal or not?

If I go to flows section of a given host, I am obtaining a list of flows which is much smaller than NNN. For example, I can have alert about 1500 flows, while I see only 100 flows in the list.

UPDATE

Screenshot

enter image description here

0

You must log in to answer this question.