Skip to main content
Version: 2.9.1

Top Applications Traffic Monitor (10036 / 20036)


(available upon request)

This Module reports unidirectional consolidated network conversations for top Applications by bandwidth. It consolidates NetFlow records over a period of time (Data collection interval) which all have the same combination of the following fields:

  • Application ID
  • Source IP address
  • Destination IP address
  • Source port number
  • Destination port number
  • Layer 3 protocol

Time trigger (Data collection interval) function โ€“ executed every 30 sec (default).

  1. Determine top N Applications by bandwidth consumption.
  2. Report all consolidated conversations for top N applications.

This information is provided per NetFlow exporter.


Parameter NameDescriptionComments
Data Collection Interval, secModule logic execution intervalmin = 5 sec, max = 600 sec, default = 30 sec
N โ€“ number of reported ApplicationsThe number of top Applications reported per NetFlow exportermin = 0, max = 100000, default = 50 (0 indicates all Applications are reported)
N โ€“ number of reported hostsThe number of hosts using top Applications reported per NetFlow exportermin = 0, max = 100000, default = 50 (0 indicates all hosts for top Applications are reported)


Palo Alto Networks NetFlow v9

Syslog/JSON Message Fieldsโ€‹

KeyField DescriptionComments
nfc_idMessage type identifierโ€œnfc_id=20036โ€
exp_ipNetFlow exporter IPv4 address<IPv4_address>
protocolTransport Protocol (TCP = 6, UDP = 17)<number>
directionDirection<string>, โ€œingressโ€ or โ€œegressโ€
dest_ipDestination host IP address<IPv4_address>
dest_ip6Destination host IPv6 address<IPv6_address>
dest_portDestination host port number<number>
src_ipSource host IPv4 address<IPv4_address>
src_ip6Source host IPv6 address<IPv6_address>
src_portSource host port number<number>
userUser-ID<string> (โ€œnaโ€ if not available)
bytes_inLayer 3 bytes from client to server<number>
packets_inPackets from client to server<number>
flow_countNumber of flows<number>
t_intObservation time interval, msec<number>