Analyzer: The connections displayed in SonicWall Analyzer differs from connections on the UTM > Status page
The connections shown on firewall status page and SonicWall Analyzer is different
NSA shows in the order of 150,000 connections, whereas Analyzer shows in the order of 500,000 connections. Both are accurate! The numbers you see for Analyzer are for the entire one hour period, since that is what the X-axis is. What NSA shows is the max number of “concurrent” connections at any given point. Analyzer shows the total number of connections in that 1-hour period. This is the primary reason.
Secondly, Analyzer uses syslogs for tracking the traffic – a syslog for a connection is sent right after the connection has closed, not while the connection is still active. So, what is shows is not the number of concurrent connections that NSA Status screen displays.