Symantec 10521146 Administration Guide - Page 240

240 Reporting Playing recorded traffic ■ Match Source or Destination: This will make a broader query on either a source IP or a destination IP. 3 In Match Source and Destination, you can display only flows that pertain to specific source and destination IPs. To make this more focused query, enter data in the following fields: ■ Source IP: Numeric IP address ■ Port: Valid port number 4 In Match Source or Destination, you can display flows that pertain to either a source IP or a destination IP. To make this broader query, enter data in the following fields: ■ Source or Destination IP: Numeric IP address ■ Port: Valid port number Note: The Network Security console displays the flow data in table format, one page at a time. You can sort the table by clicking the heading of any column. This sort, however, applies only to the page currently displayed, which may be only a portion of the entire report. At the top of the display, a prompt indicates how many flows are currently displayed, out of the total report. 5 Do one of the following: ■ Click Start Query to run a flow query based on the parameters that you configured. ■ Click Next Results to view the next page of a query that was too large to display in its entirety. ■ Click Clear to stop the active query and remove the results from display. Playing recorded traffic Like the FlowChaser, Query Current Flows, and Query Exported Flows, the Traffic Playback Tool provides another way to search recorded data outside of the Network Security reporting system. When you set a response rule to record events of a particular description, you can then use the Traffic Playback Tool to replay and scrutinize the records of those events. See "Managing response rules" on page 132.