Skip to main content
Version: 2.9.1

Top Applications Host Pairs Monitor (10037 / 20037)


(available upon request)

This Module reports bi-directional network conversations for top Applications by bandwidth. In addition to consolidating NetFlow records as in Module 10036, this Module stitches client-server (Application) request-response flows, reporting bytes and packets server-to-client and client-to-server in separate fields.

The Application side of the conversation is reported as dest_ip. Destination port is also reported. Source port of client hosts is not reported, and ignored while consolidating client-server communications. Time trigger (Data collection interval) function – executed every 30 sec (default).

  1. Determine top N Applications by bandwidth consumption.
  2. Report all consolidated conversations for top N applications

This information is provided per NetFlow exporter.


Parameter NameDescriptionComments
Data Collection Interval, secModule logic execution intervalmin = 5 sec, max = 600 sec, default = 30 sec
N – number of reported ApplicationsThe number of top Applications reported per NetFlow exportermin = 0, max = 100000, default = 50 (0 indicates all Applications are reported)
N – number of reported hostsThe number of hosts using top Applications reported per NetFlow exportermin = 0, max = 100000, default = 50 (0 indicates all hosts for top Applications are reported)


Palo Alto Networks NetFlow v9

Syslog/JSON Message Fields​

KeyField DescriptionComments
nfc_idMessage type identifierβ€œnfc_id=20037”
exp_ipNetFlow exporter IPv4 address<IPv4_address>
protocolTransport Protocol (TCP = 6, UDP = 17)<number>
dest_ipApp (Server) IP address<IPv4_address>
dest_ip6App (Server) IPv6 address<IPv6_address>
dest_portApp (Server) port number<number>
src_ipSource host IPv4 address<IPv4_address>
src_ip6Source host IPv6 address<IPv6_address>
userUser-ID<string> (β€œna” if not available)
packets_inPackets from client to server<number>
bytes_inLayer 3 bytes from client to server<number>
packets_outPackets from server to client<number>
bytes_outLayer 3 bytes from server to client<number>
bytesLayer 3 bytes in both directions<number>
flow_countNumber of flows<number>
t_intObservation time interval, msec<number>