Question:
Why do the Source and Destination app/context/instance are unknown when there is no match in our application inventory?
Answer:
Source/Destination Process highlight if the appliance sees a TCP connection with process ID's but the process ends or dies before the performance command, either WIN32_process or the Linux PS command runs to identify that process, the process will be listed and unknown as will app/context/instance.
Additionally, Source / Destination App Instance is only applicable to web (e.g. IIS) applications. This would not be populated unless the connection was associated with a web app. The Process is derived from mapping the PID within netstat and the output from the list of running processes. The Context is used for internal mapping of the process and run path info.
