Skip to content

Flow Exclusions

Purpose

Flow Exclusions is the list of ports and protocols that Clarity Transform inference ignores. Infrastructure chatter such as DNS, Kerberos and LDAP connects almost every host to almost every other, and fed into inference it would produce a graph where everything is connected. The on-screen subtitle reads: "Ports and protocols excluded from inference entirely - broadcast and infrastructure noise (DNS, DHCP, NTP) that should never be treated as application evidence."

An exclusion removes noisy traffic. To keep a noisy device, such as a backup server that talks to everything, from bridging applications, flag it on Utility Hosts instead.

Where to find it

Discover → Application Inference → Flow Exclusions. The page header is Flow Exclusions.

What you see

Columns

  • Exclusion Type: Port or Protocol. Each entry excludes a port or a protocol, not both; port entries have no protocol.
  • Port
  • Protocol
  • Notes
  • Is Seeded
  • Is Active

Seeded exclusions

The seeded exclusions, read from the product's own seed data. 27 entries ship by default, and a deployment can add or deactivate entries without changing this page, which will follow the seed data on the next build.

Excluded Type What it is
53 Port DNS
67 Port DHCP
68 Port DHCP
88 Port Kerberos
123 Port NTP
135 Port RPC endpoint mapper
137 Port NetBIOS name service
138 Port NetBIOS datagram
139 Port NetBIOS session
161 Port SNMP
162 Port SNMP trap
179 Port BGP
389 Port LDAP
464 Port Kerberos
500 Port IPSec IKE
514 Port Syslog
636 Port LDAPS
1900 Port UPnP / SSDP
3268 Port Global Catalog LDAP
3269 Port Global Catalog LDAPS
4500 Port IPSec NAT-T
5353 Port mDNS
5355 Port LLMNR
ICMP Protocol ICMP
IGMP Protocol IGMP
OSPF Protocol OSPF
VRRP Protocol VRRP

Actions

The grid uses the standard toolbar: Create New, Edit, Remove selected, Clear selection, Reload table data, Enable spreadsheet editing, Export CSV and Import CSV.

Each row has a View Details action (the eye icon).

Form

Create New opens the Create new entry form. Edit opens the Edit entry form for the selected row, with the same fields filled in. The fields, in order:

  • Exclusion Type: Port or Protocol.
  • Port
  • Protocol: text.
  • Notes: a multi-line text box.
  • Is Seeded
  • Is Active: a checkbox.

The footer has Cancel and Save.

Filters

Each column has a filter row, and the grid has a Search: box and a page-size selector (10, 25, 50 or All entries per page).

The grid remembers its Search: text, column filters, sort order and page size between visits. If the grid shows fewer rows than you expect, clear the Search: box and the filter row.

How to

Add an exclusion for the estate's own noise

  1. Go to Discover → Application Inference → Flow Exclusions.
  2. Select Create New. The Create new entry form opens.
  3. Choose the Exclusion Type. For Port, enter the Port; for Protocol, enter the Protocol.
  4. Enter Notes saying what the traffic is, and select Is Active.
  5. Select Save, or Cancel to close the form without saving.

Saving an exclusion does not start a run: exclusions apply on the next inference run. To apply them now, select Run inference on Candidate Applications, then Run grouping.

Before you exclude a port, check on Discovered Listening Ports whether an in-scope application listens on it. Excluding a port that an application uses removes real evidence, and the missing dependency is harder to notice than noise.

Stop applying an exclusion

  1. In the grid, select the exclusion's row.
  2. Select Edit. The Edit entry form opens.
  3. Clear Is Active, then select Save.
  4. Run inference again on Candidate Applications so the change takes effect.