Tech Tips: Top Protocols view on Enterprise Overview not showing custom protocol names

Document created by Christopher_Walsh Employee on Aug 11, 2014Last modified by Christopher_Walsh Employee on Dec 17, 2016
Version 3Show Document
  • View in full screen mode

Issue

When viewing the Enterprise Overview page in RA/NFA the 'Top Protocols' may not show any edited Protocol Names or Protocol Names created through Application Mappings.

 

For example below you will see TCP-3389, but in the 'Administration->Protocol Names' I renamed this to 'Windows Server RDP', but it does not reflect in the 'Top Protocols' view.

TopProts.png

 

 

 

However when looking at other NFA reports not on the Enterprise Overview page, you do see the edited Protocol Names.

 

 

 

 

Resolution

This occurs when RA/NFA has more than one domain in the 'reporter.domains' table.

 

To verify, login to the reporter database on the RA/NFA console server and query the domains table to see if there is more than just the default domain here.

mysql -P3308 reporter

select * from domains;

 

If there are more than one, you can delete these from the NPC/CAPC server and perform a full resync of the RA/NFA data source.

 

In NPC the domains are located under 'Admin->Groups->All Groups->System-Groups->All Domains'.

You can delete the non default domains if not needed from here then do a full resync of the RA/NFA data source and verify in the RA/NFA database after the sync that there is only one domain using the query above.

 

In CAPC you can simply go to "Admin->Domains" to find and delete the domains, then also do a Full resync of the NFA data source.

 

Once the domains have been deleted, and the RA/NFA data sources has gone through a Full Resync from NPC/CAPC, go back to the Enterprise Overview page.

You should now see the 'Top Protocols' view reflects the edited Protocol Names like below for 'Windows Server RDP'.

TopProtsCorrect.png

Attachments

    Outcomes