Chapter 10. Network flows format reference

Source namespace

Destination namespace

Source owner, such as Deployment, StatefulSet, etc.

Destination owner, such as Deployment, StatefulSet, etc.

Flow direction from the node observation point

Type of record: 'flowLog' for regular flow logs, or 'allConnections', 'newConnection', 'heartbeat', 'endConnection' for conversation tracking

Source IP address (ipv4 or ipv6)

Destination IP address (ipv4 or ipv6)

Source MAC address

Destination MAC address

Name of the source matched Kubernetes object, such as Pod name, Service name, etc.

Name of the destination matched Kubernetes object, such as Pod name, Service name, etc.

Kind of the source matched Kubernetes object, such as Pod, Service, etc.

Kind of the destination matched Kubernetes object, such as Pod name, Service name, etc.

Source port

Destination port

Kind of the source Kubernetes owner, such as Deployment, StatefulSet, etc.

Kind of the destination Kubernetes owner, such as Deployment, StatefulSet, etc.

Source node IP

Destination node IP

Source node name

Destination node name

L4 protocol

Network interface

Flow direction from the network interface observation point

TCP flags

Number of packets

In conversation tracking, A to B packets counter per conversation

In conversation tracking, B to A packets counter per conversation

Number of bytes

In conversation tracking, A to B bytes counter per conversation

In conversation tracking, B to A bytes counter per conversation

ICMP type

ICMP code

Pkt TCP state for drops

Pkt cause for drops

Pkt TCP flags for drops

Number of packets dropped by the kernel

In conversation tracking, A to B packets dropped counter per conversation

In conversation tracking, B to A packets dropped counter per conversation

Number of bytes dropped by the kernel

In conversation tracking, A to B bytes dropped counter per conversation

In conversation tracking, B to A bytes dropped counter per conversation

DNS record id

DNS flags for DNS record

Parsed DNS header RCODEs name

Calculated time between response and request, in milliseconds

Start timestamp of this flow, in milliseconds

End timestamp of this flow, in milliseconds

Timestamp when this flow was received and processed by the flow collector, in seconds

Flow Round Trip Time (RTT) in nanoseconds

In conversation tracking, the conversation identifier

In conversation tracking, a flag identifying the first flow

In conversation tracking, a counter of flow logs per conversation

Incoming traffic, from the node observation point

Outgoing traffic, from the node observation point

Inner traffic, with the same source and destination node