I am exploring ntopng reports on my router and seeing, that one computer on my LAN
is a flooder.
ntopng
says Host XXX.XXX.XXX.XXX is a flooder [NNN new flows in the last 3 sec]
How to explore these flows in more detail to know if they are legal or not?
If I go to flows
section of a given host, I am obtaining a list of flows which is much smaller than NNN
. For example, I can have alert about 1500 flows, while I see only 100 flows in the list.
UPDATE
Screenshot