Network traffic and flows

The sensor captures network traffic from the SPAN or port mirroring port. This is a passive copy of the traffic crossing the monitored network segment, so the sensor does not inject any packets.

The coverage of traffic capture depends entirely on what the network switch sends to the SPAN port. If only certain VLANs are mirrored, only traffic on those VLANs is visible.

A flow is a summary record of communication between two endpoints. This record includes source and destination IPs, ports, protocol, byte count, and timestamps. Flows are aggregated from raw traffic and stored in a time-series database for analysis over time.

Traffic refers to the raw packet data the sensor observes. The sensor processes this in real time to extract flows, detect anomalies, and feed the detection rules.

A capture or network capture is a saved packet dump. You can download this PCAP file for offline analysis in tools like Wireshark. Captures can be triggered manually or automatically as a response action when an alert group fires.

Flows are classified based on whether the destination is inside your network or external. This classification uses your configured network aliases. External IPs are enriched with country and organization data. The sensor identifies the application layer protocol where possible, such as HTTP, Modbus, S7, or OPC UA.

Flows are stored in a time-series database with their own retention policy. This retention policy is separate from the main inventory database.