NetworkFlow collector

The NetworkFlow collector gathers historical data on network usage from managed devices.

Note
To gather information using the NetworkFlow collector, make sure Enable Plug-in and Enable Network Sniffing are selected in the Network Flow policy.

Collector output

Field	Type	Description
src_ip	IPv4 or IPv6 address	IP address of the source of the packet. Supports CIDR block notation.
src_port	Number	Port number originating the packet.
dst_ip	IPv4 or IPv6 address	IP address of the destination of the packet. Supports CIDR block notation.
dst_port	Number	Port number receiving the packet.
time	Timestamp	Date and time when the packet was collected.
status	String	The status of the TCP transaction (not available in UDP transactions). The TCP status must be interpreted as follows: On a TCP connection open operation, the `CONNECTED` value means that the source endpoint sent a `SYN` message and received an `ACK,SYN` message from the remote server. On a TCP connection close operation, the `CLOSED` value means that the source endpoint sent a `SYN` message and received an `ACK,FIN` message from the destination server. The final `ACK` message is ignored on both open and close operations. Important The TCP status must be interpreted as follows: On a TCP connection open operation, the `CONNECTED` value means that the source endpoint sent a `SYN` message and received an `ACK,SYN` message from the remote server. On a TCP connection close operation, the `CLOSED` value means that the source endpoint sent a `SYN` message and received an `ACK,FIN` message from the destination server. The final `ACK` message is ignored on both open and close operations.
process	String	The originating process image name.
process_id	Number	The originating process ID.
user	String	The user that owns the originating process.
user_id	String	The user ID of the process owning the socket.
proto	String	The packet's protocol: TCP or UDP.
direction	String	Specifies whether the packet came `in` to the managed device, or was sent `out` of the device.
ip_class	Number	Specifies the IP class used for the transaction: IPv4 returns `0` IPv6 returns `1` Unknown returns `2`
seq_number	Number	TCP transaction sequence number (not available in UDP transactions).
src_mac	String	MAC address of originating device.
dst_mac	String	MAC address of destination device (Linux only).
md5	String	The MD5 hash code for the source process.
sha1	String	The SHA-1 hash code for the source process.
sha256	String	The SHA-256 hash code for the source process (Windows, macOS only).

Supported versions

Windows	Linux	macOS
3.0 and later	3.0 and later	3.0 and later

Example: Show process IDs and image names for network flow originating on CIDR block 10.250.45.0/24 and targeting device 10.0.0.2.

NetworkFlow process, process_id where NetworkFlow src_ip contains 10.250.45.0/24 and NetworkFlow dst_ip equals 10.0.0.2

Connections by dest port 53

NetworkFlow status, proto, direction, src_ip, src_port, dst_ip, dst_port
    WHERE NetworkFlow dst_port equals "53"

Connections by OSI protocol - single

NetworkFlow status, proto, direction, src_ip, src_port, dst_ip, dst_port
    WHERE NetworkFlow dst_port equals "53"
        AND NetworkFlow proto equals "tcp"

Connections by OSI protocol - many

NetworkFlow status, proto, direction, src_ip, src_port, dst_ip, dst_port
    WHERE NetworkFlow dst_port equals "53"
        AND NetworkFlow proto equals "tcp"
            OR NetworkFlow proto equals "udp"

Connections by dest port number - single

NetworkFlow status, proto, direction, src_ip, src_port, dst_ip, dst_port
    WHERE NetworkFlow dst_port equals "53"

Connections by dest port number - many

NetworkFlow status, proto, direction, src_ip, src_port, dst_ip, dst_port
    WHERE NetworkFlow dst_port equals "53"
        OR NetworkFlow dst_port equals "443"
        OR NetworkFlow dst_port equals "80"

Connections by dest IP and dest port 53 - single

NetworkFlow status, proto, direction, src_ip, src_port, dst_ip, dst_port
    WHERE NetworkFlow dst_port equals "53"
        AND NetworkFlow dst_ip equals "10.0.0.1"

Connections by dest IP and dest port 53 - many

NetworkFlow status, proto, direction, src_ip, src_port, dst_ip, dst_port
    WHERE NetworkFlow dst_port equals "53"
        AND NetworkFlow dst_ip equals "10.0.0.1"
            OR NetworkFlow dst_ip equals "10.0.0.2"
            OR NetworkFlow dst_ip equals "10.0.0.3"