Unclassified traffic...what can I do

Question

So, the Daily Executive Report has a fair amount of "unclassified" traffic. Is there anything I could do to determine what this traffic is without staring at the log all day? Where if any documentation would allow me to understand this better? The utm9351 admin manual? I'm still looking through. 
 Any information or suggestions would be helpful, as well if perhaps just being too OCD. I accept that. However, I would like to know since the percentage is high enough to want to know what is happening and what type of traffic it is.

Scott_Klassen · Accepted Answer

Classified apps are based on various parameter, usually unique port(s) used by a particular service or a list of know servers that are utilized. If the UTM doesn't have those definition parameters, because the app uses dynamic/non-unique ports or is constantly changing servers, the app shows as unclassified. Hit the various reports under logging and reporting to find the port(s) used, the remote server address, and the address of your client machine. You can then use a combination of your knowledge of what's installed on your client machine, the data in the reports and logs on the UTM, google searches, and whois lookups/nslookups to possibly track things down one by one.