dt-obs-network-flows

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Network Flows Skill

Analyze network traffic in Dynatrace across three flow data sources. This skill covers the use cases network flows enable and routes each question to the right source and reference file. The detailed, source-specific DQL lives in the reference files.

在Dynatrace中通过三个流数据源分析网络流量。本技能涵盖了network flows支持的使用场景，并会将每个问题路由到对应的数据源和参考文件。特定数据源的详细DQL存放在参考文件中。

What Network Flows Tell You

Network Flows 能告诉你什么

Network flow data answers questions that metrics and traces cannot:

Who talks to whom — communication dependencies between hosts, processes, pods, services, and external endpoints
Top talkers — which entities generate the most traffic, by bytes or connection count
Connection health — resets, timeouts, retransmissions, and round-trip time (RTT) per conversation
Traffic composition — protocol (TCP/UDP), destination ports, direction (client vs server)
Peer resolution — mapping raw IP:port peers back to monitored entities (host, process, pod, service) or flagging them as external

网络流数据可以解答指标和追踪无法回答的问题：

通信对象 — 主机、进程、Pod、服务与外部端点之间的通信依赖关系
顶级通信方 — 哪些实体产生的流量最多（按字节数或连接数统计）
连接健康状况 — 每个会话的重置、超时、重传以及往返时间（RTT）
流量构成 — 协议（TCP/UDP）、目标端口、通信方向（客户端 vs 服务器）
对等方解析 — 将原始IP:port对等方映射回受监控实体（主机、进程、Pod、服务），或标记为外部实体

The Three Flow Sources

三个流数据源

Choose the source based on where the traffic is and what is capturing it. When more than one applies, prefer the source with the richest entity context (usually OneAgent).

Source	Captured by	Data location	Entity context	Use when
OneAgent flows	OneAgent network agent on the host	events in the `default_network_flows` Grail bucket	Rich — the capturing entity (client or server) resolved to host / process / pod smartscape IDs; the remote peer as IP:port	Traffic to/from OneAgent-monitored hosts, processes, or Kubernetes pods. The default and most detailed source.
NetFlow / IPFIX / sFlow	Network devices (switches, routers), ingested via an OpenTelemetry Collector	logs ( `otel.scope.name == "otelcol/netflowreceiver"` ; recommend routing to a dedicated bucket)	Device/interface level — raw IPs, exporter, interfaces; no smartscape entities	Traffic seen by network hardware. Covers east-west and north-south flows at the network layer.
Cloud flow logs	Cloud provider (AWS VPC / TGW; Azure, GCP not yet documented)	logs ( `log.type == "aws.vpc"` / `"aws.tgw"` ; recommend routing to a dedicated bucket)	Cloud resource level — VPC / subnet / AZ / ENI, TGW attachment; raw IPs, no smartscape entities	Traffic within/across cloud networks, including managed services and resources without an agent.

根据流量所在位置和采集方式选择数据源。当多个数据源适用时，优先选择实体上下文最丰富的数据源（通常是OneAgent）。

数据源	采集方式	数据位置	实体上下文	使用场景
OneAgent flows	主机上的OneAgent网络代理	`default_network_flows` Grail存储桶中的events	丰富 — 采集实体（客户端或服务器）已解析为主机/进程/Pod的Smartscape ID；远程对等方以IP:port形式呈现	与OneAgent监控的主机、进程或Kubernetes Pod相关的流量。默认且最详细的数据源。
NetFlow / IPFIX / sFlow	网络设备（交换机、路由器），通过OpenTelemetry Collector采集	logs（ `otel.scope.name == "otelcol/netflowreceiver"` ；建议路由到专用存储桶）	设备/接口级别 — 原始IP、导出器、接口；无Smartscape实体	网络硬件可见的流量。涵盖网络层的东西向和南北向流量。
云流日志	云提供商（AWS VPC / TGW；Azure、GCP暂未文档化）	logs（ `log.type == "aws.vpc"` / `"aws.tgw"` ；建议路由到专用存储桶）	云资源级别 — VPC / 子网 / AZ / ENI、TGW附件；原始IP，无Smartscape实体	云网络内部/跨云网络的流量，包括无代理的托管服务和资源。

Routing logic

路由逻辑

Is the traffic to/from a OneAgent-monitored host, process, or pod? → OneAgent flows. See references/oneagent-flows/oneagent-flows.md.
Is it device-level or from unmonitored hosts? → NetFlow. See references/netflow/netflow.md.
Is it cloud-network / managed-service traffic? → Cloud flow logs (per provider). AWS: references/cloud-flows/aws/aws.md.

The three sources overlap. A pod-to-pod flow may appear in both OneAgent flows (with full pod context) and cloud flow logs (as ENI-to-ENI). Lead with the source that carries the entity context the user needs, and mention the alternative only if the primary source has no data.

流量是否与OneAgent监控的主机、进程或Pod相关？ → 使用OneAgent flows。查看references/oneagent-flows/oneagent-flows.md。
是否为设备级流量或来自未监控主机的流量？ → 使用NetFlow。查看references/netflow/netflow.md。
是否为云网络/托管服务流量？ → 使用云流日志（按提供商分类）。AWS：references/cloud-flows/aws/aws.md。

三个数据源存在重叠。Pod到Pod的流量可能同时出现在OneAgent flows（含完整Pod上下文）和云流日志（以ENI到ENI形式呈现）中。优先使用用户所需实体上下文对应的数据源，仅当主数据源无数据时再提及替代数据源。

Related Network Data in Dynatrace

Dynatrace中的相关网络数据

Network flows are one part of Dynatrace's network observability. Route to these when the question is not about flows:

The user wants…	Use
Host NIC throughput, link utilization, packet drops/errors	dt-obs-hosts → `references/host-metrics.md` (Network Monitoring section)
Process-level network I/O and TCP connection quality metrics	dt-obs-hosts → `references/process-monitoring.md`
Kubernetes pod connections and cluster network topology	dt-obs-kubernetes
Service request rate, latency, error rate	dt-obs-services
External / synthetic uptime and network-availability monitors	dt-obs-ext-monitors
Network devices — switches, routers, firewalls (SNMP/monitoring)	`dt-obs-network-devices` (planned — not yet available)

A future macro dt-obs-network
skill may connect all network concepts (devices, hosts/process/pod metrics, flows, availability monitors, cloud network monitoring). Until it exists, this skill carries the flow-specific cross-links above.

网络流是Dynatrace网络可观测性的一部分。当问题与流无关时，请路由到以下技能：

用户需求…	使用技能
主机NIC吞吐量、链路利用率、丢包/错误统计	dt-obs-hosts → `references/host-metrics.md` （网络监控章节）
进程级网络I/O和TCP连接质量指标	dt-obs-hosts → `references/process-monitoring.md`
Kubernetes Pod连接和集群网络拓扑	dt-obs-kubernetes
服务请求率、延迟、错误率	dt-obs-services
外部/合成可用性和网络可用性监控	dt-obs-ext-monitors
网络设备 — 交换机、路由器、防火墙（SNMP/监控）	`dt-obs-network-devices` （规划中 — 暂未可用）

未来可能会推出一个**
dt-obs-network
**宏技能，整合所有网络相关概念（设备、主机/进程/Pod指标、流、可用性监控、云网络监控）。在此之前，本技能包含上述流相关的交叉链接。

Reference Files

参考文件

references/oneagent-flows/oneagent-flows.md — Validated. Data model, field reference, and DQL for the
```
default_network_flows
```
bucket: top talkers, traffic maps, protocol/port breakdowns, connection health (resets/timeouts/retransmissions/RTT), bandwidth in bps, and which side of a flow is the peer.
references/peer-resolution/peer-resolution.md — Validated. Shared Smartscape lookups that resolve a raw flow IP (and optional port) to a monitored host, process, Kubernetes pod, or service (host → pod → service → external). Used by both OneAgent flows and NetFlow.
references/oneagent-flows/configuration.md — Enabling and tuning
```
builtin:network-connection-monitoring
```
(the setting that produces OneAgent flow data).
references/netflow/netflow.md — Validated. NetFlow/IPFIX/sFlow ingested via an OpenTelemetry Collector into
```
logs
```
: data model, direction semantics (unidirectional, no client/server role), and DQL for top conversations/talkers/ports, protocol breakdowns, traffic-over-time, and per-exporter/per-interface views.
references/netflow/configuration.md — OTel Collector
```
netflow
```
-receiver ingestion path and the dedicated-bucket routing recommendation for netflow logs.
references/cloud-flows/aws/aws.md — Validated (AWS). AWS VPC Flow Logs and Transit Gateway flow logs ingested into
```
logs
```
:
```
aws.vpc
```
/
```
aws.tgw
```
field model (incl.
```
pkt_srcaddr
```
vs
```
srcaddr
```
,
```
log_status
```
filtering), and DQL for top conversations/talkers/ports, rejected-traffic (security), egress
```
traffic_path
```
, per-VPC/subnet/AZ, inter-VPC, traffic-over-time, and TGW packet-loss. Also AWS entity resolution — ENI/instance by id or IP-in-
```
aws.object
```
— for agentless resources the shared peer lookups miss.
references/cloud-flows/aws/configuration.md — Amazon Data Firehose ingestion path for AWS flow logs and the dedicated-bucket routing recommendation.
(Azure NSG/VNet and GCP VPC flow logs are not yet documented; add them as sibling
cloud-flows/<provider>/
folders when tenant data is available.)

references/oneagent-flows/oneagent-flows.md — 已验证。
```
default_network_flows
```
存储桶的数据模型、字段参考和DQL：顶级通信方、流量映射、协议/端口细分、连接健康状况（重置/超时/重传/RTT）、带宽（bps）以及流的对等方角色。
references/peer-resolution/peer-resolution.md — 已验证。 共享的Smartscape查找功能，可将原始流IP（可选端口）解析为受监控的主机、进程、Kubernetes Pod或服务（主机 → Pod → 服务 → 外部）。OneAgent flows和NetFlow均会使用此功能。
references/oneagent-flows/configuration.md — 启用和调优
```
builtin:network-connection-monitoring
```
（生成OneAgent流数据的设置）。
references/netflow/netflow.md — 已验证。 通过OpenTelemetry Collector采集到
```
logs
```
中的NetFlow/IPFIX/sFlow：数据模型、方向语义（单向，无客户端/服务器角色）以及用于顶级会话/通信方/端口、协议细分、流量随时间变化、按导出器/接口查看的DQL。
references/netflow/configuration.md — OTel Collector的
```
netflow
```
接收器采集路径，以及NetFlow日志路由到专用存储桶的建议。
references/cloud-flows/aws/aws.md — 已验证（AWS）。 采集到
```
logs
```
中的AWS VPC流日志和传输网关流日志：
```
aws.vpc
```
/
```
aws.tgw
```
字段模型（包括
```
pkt_srcaddr
```
与
```
srcaddr
```
的区别、
```
log_status
```
过滤），以及用于顶级会话/通信方/端口、拒绝流量（安全）、出口
```
traffic_path
```
、按VPC/子网/AZ查看、跨VPC流量、流量随时间变化、TGW丢包的DQL。还包括AWS实体解析 — 通过ID或
```
aws.object
```
中的IP查找ENI/实例 — 用于共享对等方查找未覆盖的无代理资源。
references/cloud-flows/aws/configuration.md — AWS流日志的Amazon Data Firehose采集路径，以及路由到专用存储桶的建议。
(Azure NSG/VNet和GCP VPC流日志暂未文档化；当有租户数据可用时，将添加为同级
cloud-flows/<provider>/
文件夹。)