NFO 2.8.1
Powered By GitBook
Top Applications Traffic Monitor (10036 / 20036)
(available upon request)

Description

This Module reports unidirectional consolidated network conversations for top Applications by bandwidth. It consolidates NetFlow records over a period of time (Data collection interval) which all have the same combination of the following fields:
    Application ID
    Source IP address
    Destination IP address
    Source port number
    Destination port number
    Layer 3 protocol
Time trigger (Data collection interval) function – executed every 30 sec (default).
    1.
    Determine top N Applications by bandwidth consumption.
    2.
    Report all consolidated conversations for top N applications.
This information is provided per NetFlow exporter.

Parameters

Parameter Name
Description
Comments
Data Collection Interval, sec
Module logic execution interval
min = 5 sec, max = 600 sec, default = 30 sec
N – number of reported Applications
The number of top Applications reported per NetFlow exporter
min = 0, max = 100000,
default = 50 (0 indicates all Applications are reported)
N – number of reported hosts
The number of hosts using top Applications reported per NetFlow exporter
min = 0, max = 100000,
default = 50 (0 indicates all hosts for top Applications are reported)

Input

Palo Alto Networks NetFlow v9

Syslog/JSON Message Fields

Key
Field Description
Comments
nfc_id
Message type identifier
“nfc_id=20036”
exp_ip
NetFlow exporter IPv4 address
<IPv4_address>
protocol
Transport Protocol (TCP = 6, UDP = 17)
<number>
direction
Direction
<string>, “ingress” or “egress”
app
Application
<string>
dest_ip
Destination host IP address
<IPv4_address>
dest_ip6
Destination host IPv6 address
<IPv6_address>
dest_port
Destination host port number
<number>
src_ip
Source host IPv4 address
<IPv4_address>
src_ip6
Source host IPv6 address
<IPv6_address>
src_port
Source host port number
<number>
user
User-ID
<string> (“na” if not available)
bytes_in
Layer 3 bytes from client to server
<number>
packets_in
Packets from client to server
<number>
flow_count
Number of flows
<number>
t_int
Observation time interval, msec
<number>
Last modified 1yr ago