Skip to main content
Version: 2.10.2

Top Applications Traffic Monitor (10036 / 20036)

Description

note

This Module is available upon request

This Module reports unidirectional consolidated network conversations for top Applications by bandwidth. It consolidates NetFlow records over a period of time (Data collection interval) which all have the same combination of the following fields:

  • Application ID
  • Source IP address
  • Destination IP address
  • Source port number
  • Destination port number
  • Layer 3 protocol

Time trigger (Data collection interval) function – executed every 30 sec (default).

  1. Determine top N Applications by bandwidth consumption.
  2. Report all consolidated conversations for top N applications.

This information is provided per NetFlow exporter.

Parameters

Parameter NameDescriptionComments
Data Collection Interval, secModule logic execution intervalmin = 5 sec, max = 600 sec, default = 30 sec
N – number of reported ApplicationsThe number of top Applications reported per NetFlow exportermin = 0, max = 100000, default = 50 (0 indicates all Applications are reported)
N – number of reported hostsThe number of hosts using top Applications reported per NetFlow exportermin = 0, max = 100000, default = 50 (0 indicates all hosts for top Applications are reported)

Input

Palo Alto Networks NetFlow v9

Syslog/JSON Message Fields

KeyField DescriptionComments
nfc_idMessage type identifier“nfc_id=20036”
exp_ipNetFlow exporter IPv4 address<IPv4_address>
protocolTransport Protocol (TCP = 6, UDP = 17)<number>
directionDirection<string>, “ingress” or “egress”
appApplication<string>
dest_ipDestination host IP address<IPv4_address>
dest_ip6Destination host IPv6 address<IPv6_address>
dest_portDestination host port number<number>
src_ipSource host IPv4 address<IPv4_address>
src_ip6Source host IPv6 address<IPv6_address>
src_portSource host port number<number>
userUser-ID<string> (“na” if not available)
bytes_inLayer 3 bytes from client to server<number>
packets_inPackets from client to server<number>
flow_countNumber of flows<number>
t_intObservation time interval, msec<number>