An engineer is reviewing a ticket that requests to allow traffic for some devices that must connect to a server over 8699/udp. The request mentions only one IP address, 172.16.18.15, but the…

Using context explorer to see application blocks by protocol is too broad; the request is for a specific server and port, and the goal is to find sources, not just general application blocks.

Using context explorer to see destination port blocks is a possibility, but directly filtering 'connection events' provides more granular detail including source IPs and exact timestamps, which is more effective for this specific troubleshooting scenario.

Filtering by the source port 8699/udp is incorrect because 8699/udp is the destination port on the server; the source ports for clients would be ephemeral, not the service port.

The request specifies allowing traffic to a server on port 8699/udp. To identify all client machines that have been trying to connect to this server on this specific port, filtering connection events by the destination port 8699/udp will show all traffic targeting that service, including blocked attempts, and reveal the source IPs of those trying to connect.