The CurrentFlow collector gathers real-time data on the network flow from managed devices.
Note
To gather information using the NetworkFlow collector, make sure Enable Plug-in and Enable Network Sniffing are selected in the Network Flow policy.
Field | Type | Description |
|---|---|---|
local_ip | IPv4 or IPv6 address | IP address of the source of the packet. Supports CIDR block notation. |
local_port | Number | Port number originating the packet. |
remote_ip | IPv4 or IPv6 address | IP address of the destination of the packet. Supports CIDR block notation. |
remote_port | Number | Port number receiving the packet. |
status | String | The status of the TCP transaction (not available in UDP transactions). |
process_id | Number | The originating process's ID. |
user | String | The user that owns the originating process. |
user_id | String | The user ID of the process owning the socket. |
proto | String | The packet's protocol: TCP or UDP. |
md5 | String | The MD5 hash code for the source process. |
sha1 | String | The SHA-1 hash code for the source process. |
sha256 | String | The SHA-256 hash code for the source process. |
CurrentFlow process_id where CurrentFlow local_ip contains 10.250.45.0/24 and CurrentFlow remote_ip equals 10.0.0.2
CurrentFlow process_id where CurrentFlow local_ip contains 10.250.45.0/24 and CurrentFlow remote_ip equals 10.0.0.2
Important
For this collector to work on Linux, you must install the
net-toolspackage. In some Linux distributions this package is not installed by default.