Top Applications Traffic Monitor (10036 / 20036)
Description
(available upon request)
This Module reports unidirectional consolidated network conversations for top Applications by bandwidth. It consolidates NetFlow records over a period of time (Data collection interval) which all have the same combination of the following fields:
- Application ID
- Source IP address
- Destination IP address
- Source port number
- Destination port number
- Layer 3 protocol
Time trigger (Data collection interval) function – executed every 30 sec (default).
- Determine top N Applications by bandwidth consumption.
- Report all consolidated conversations for top N applications.
This information is provided per NetFlow exporter.
Parameters
| Parameter Name | Description | Comments |
|---|---|---|
| Data Collection Interval, sec | Module logic execution interval | min = 5 sec, max = 600 sec, default = 30 sec |
| N – number of reported Applications | The number of top Applications reported per NetFlow exporter | min = 0, max = 100000, default = 50 (0 indicates all Applications are reported) |
| N – number of reported hosts | The number of hosts using top Applications reported per NetFlow exporter | min = 0, max = 100000, default = 50 (0 indicates all hosts for top Applications are reported) |
Input
Palo Alto Networks NetFlow v9
Syslog/JSON Message Fields
| Key | Field Description | Comments |
|---|---|---|
| nfc_id | Message type identifier | “nfc_id=20036” |
| exp_ip | NetFlow exporter IPv4 address | <IPv4_address> |
| protocol | Transport Protocol (TCP = 6, UDP = 17) | <number> |
| direction | Direction | <string>, “ingress” or “egress” |
| app | Application | <string> |
| dest_ip | Destination host IP address | <IPv4_address> |
| dest_ip6 | Destination host IPv6 address | <IPv6_address> |
| dest_port | Destination host port number | <number> |
| src_ip | Source host IPv4 address | <IPv4_address> |
| src_ip6 | Source host IPv6 address | <IPv6_address> |
| src_port | Source host port number | <number> |
| user | User-ID | <string> (“na” if not available) |
| bytes_in | Layer 3 bytes from client to server | <number> |
| packets_in | Packets from client to server | <number> |
| flow_count | Number of flows | <number> |
| t_int | Observation time interval, msec | <number> |