Console
    Contact Us Start free

    Network

    A network event.

    JSON representation 
     { 
 "sent_bytes" 
 : 
 string 
 , 
 "received_bytes" 
 : 
 string 
 , 
 "sent_packets" 
 : 
 string 
 , 
 "received_packets" 
 : 
 string 
 , 
 "session_duration" 
 : 
 string 
 , 
 "session_id" 
 : 
 string 
 , 
 "parent_session_id" 
 : 
 string 
 , 
 "application_protocol_version" 
 : 
 string 
 , 
 "community_id" 
 : 
 string 
 , 
 "direction" 
 : 
 enum (  Direction 
 
) 
 , 
 "ip_protocol" 
 : 
 enum (  IpProtocol 
 
) 
 , 
 "application_protocol" 
 : 
 enum (  ApplicationProtocol 
 
) 
 , 
 "ftp" 
 : 
 { 
 object (  Ftp 
 
) 
 } 
 , 
 "email" 
 : 
 { 
 object (  Email 
 
) 
 } 
 , 
 "dns" 
 : 
 { 
 object (  Dns 
 
) 
 } 
 , 
 "dhcp" 
 : 
 { 
 object (  Dhcp 
 
) 
 } 
 , 
 "http" 
 : 
 { 
 object (  Http 
 
) 
 } 
 , 
 "tls" 
 : 
 { 
 object (  Tls 
 
) 
 } 
 , 
 "smtp" 
 : 
 { 
 object (  Smtp 
 
) 
 } 
 , 
 "asn" 
 : 
 string 
 , 
 "dns_domain" 
 : 
 string 
 , 
 "carrier_name" 
 : 
 string 
 , 
 "organization_name" 
 : 
 string 
 , 
 "ip_subnet_range" 
 : 
 string 
 }
    Fields
    sent_bytes

    string

    The number of bytes sent.
    received_bytes

    string

    The number of bytes received.
    sent_packets

    string ( int64 format)

    The number of packets sent.
    received_packets

    string ( int64 format)

    The number of packets received.
    session_duration

    string ( Duration format)

    The duration of the session as the number of seconds and nanoseconds. For seconds, network.session_duration.seconds, the type is a 64-bit integer. For nanoseconds, network.session_duration.nanos, the type is a 32-bit integer.

    A duration in seconds with up to nine fractional digits, ending with ' s '. Example: "3.5s" .
    session_id

    string

    The ID of the network session.
    parent_session_id

    string

    The ID of the parent network session.
    application_protocol_version

    string

    The version of the application protocol. e.g. "1.1, 2.0"
    community_id

    string

    Community ID network flow value.
    direction

    enum ( Direction )

    The direction of network traffic.
    ip_protocol

    enum ( IpProtocol )

    The IP protocol.
    application_protocol

    enum ( ApplicationProtocol )

    The application protocol.
    ftp

    object ( Ftp )

    FTP info.
    email

    object ( Email )

    Email info for the sender/recipient.
    dns

    object ( Dns )

    DNS info.
    dhcp

    object ( Dhcp )

    DHCP info.
    http

    object ( Http )

    HTTP info.
    tls

    object ( Tls )

    TLS info.
    smtp

    object ( Smtp )

    SMTP info. Store fields specific to SMTP not covered by Email.
    asn

    string

    Autonomous system number.
    dns_domain

    string

    DNS domain name.
    carrier_name

    string

    Carrier identification.
    organization_name

    string

    Organization name (e.g Google).
    ip_subnet_range

    string

    Associated human-readable IP subnet range (e.g. 10.1.2.0/24).

    Ftp

    FTP info.

    JSON representation 
     { 
 "command" 
 : 
 string 
 }
    Fields
    command

    string

    The FTP command.

    Dns

    DNS information.

    JSON representation 
     { 
 "id" 
 : 
 integer 
 , 
 "response" 
 : 
 boolean 
 , 
 "opcode" 
 : 
 integer 
 , 
 "authoritative" 
 : 
 boolean 
 , 
 "truncated" 
 : 
 boolean 
 , 
 "recursion_desired" 
 : 
 boolean 
 , 
 "recursion_available" 
 : 
 boolean 
 , 
 "response_code" 
 : 
 integer 
 , 
 "questions" 
 : 
 [ 
 { 
 object (  Question 
 
) 
 } 
 ] 
 , 
 "answers" 
 : 
 [ 
 { 
 object (  ResourceRecord 
 
) 
 } 
 ] 
 , 
 "authority" 
 : 
 [ 
 { 
 object (  ResourceRecord 
 
) 
 } 
 ] 
 , 
 "additional" 
 : 
 [ 
 { 
 object (  ResourceRecord 
 
) 
 } 
 ] 
 }
    Fields
    id

    integer ( uint32 format)

    DNS query id.
    response

    boolean

    Set to true if the event is a DNS response. See QR field from RFC1035.
    opcode

    integer ( uint32 format)

    The DNS OpCode used to specify the type of DNS query (for example, QUERY, IQUERY, or STATUS).
    authoritative

    boolean

    Other DNS header flags. See RFC1035, section 4.1.1.
    truncated

    boolean

    Whether the DNS response was truncated.
    recursion_desired

    boolean

    Whether a recursive DNS lookup is desired.
    recursion_available

    boolean

    Whether a recursive DNS lookup is available.
    response_code

    integer ( uint32 format)

    Response code. See RCODE from RFC1035.
    questions[]

    object ( Question )

    A list of domain protocol message questions.
    answers[]

    object ( ResourceRecord )

    A list of answers to the domain name query.
    authority[]

    object ( ResourceRecord )

    A list of domain name servers which verified the answers to the domain name queries.
    additional[]

    object ( ResourceRecord )

    A list of additional domain name servers that can be used to verify the answer to the domain.

    Question

    DNS Questions. See RFC1035, section 4.1.2.

    JSON representation 
     { 
 "name" 
 : 
 string 
 , 
 "type" 
 : 
 integer 
 , 
 "class" 
 : 
 integer 
 , 
 "prevalence" 
 : 
 { 
 object (  Prevalence 
 
) 
 } 
 }
    Fields
    name

    string

    The domain name.
    type

    integer ( uint32 format)

    The code specifying the type of the query.
    class

    integer ( uint32 format)

    The code specifying the class of the query.
    prevalence

    object ( Prevalence )

    The prevalence of the domain within the customer's environment.

    ResourceRecord

    DNS Resource Records. See RFC1035, section 4.1.3.

    JSON representation 
     { 
 "name" 
 : 
 string 
 , 
 "type" 
 : 
 integer 
 , 
 "class" 
 : 
 integer 
 , 
 "ttl" 
 : 
 integer 
 , 
 "data" 
 : 
 string 
 , 
 "binary_data" 
 : 
 string 
 }
    Fields
    name

    string

    The name of the owner of the resource record.
    type

    integer ( uint32 format)

    The code specifying the type of the resource record.
    class

    integer ( uint32 format)

    The code specifying the class of the resource record.
    ttl

    integer ( uint32 format)

    The time interval for which the resource record can be cached before the source of the information should again be queried.
    data

    string

    The payload or response to the DNS question for all responses encoded in UTF-8 format
    binary_data

    string ( bytes format)

    The raw bytes of any non-UTF8 strings that might be included as part of a DNS response.

    A base64-encoded string.

    Dhcp

    DHCP information.

    JSON representation 
     { 
 "opcode" 
 : 
 enum (  OpCode 
 
) 
 , 
 "htype" 
 : 
 integer 
 , 
 "hlen" 
 : 
 integer 
 , 
 "hops" 
 : 
 integer 
 , 
 "transaction_id" 
 : 
 integer 
 , 
 "seconds" 
 : 
 integer 
 , 
 "flags" 
 : 
 integer 
 , 
 "ciaddr" 
 : 
 string 
 , 
 "yiaddr" 
 : 
 string 
 , 
 "siaddr" 
 : 
 string 
 , 
 "giaddr" 
 : 
 string 
 , 
 "chaddr" 
 : 
 string 
 , 
 "sname" 
 : 
 string 
 , 
 "file" 
 : 
 string 
 , 
 "options" 
 : 
 [ 
 { 
 object (  Option 
 
) 
 } 
 ] 
 , 
 "type" 
 : 
 enum (  MessageType 
 
) 
 , 
 "lease_time_seconds" 
 : 
 integer 
 , 
 "client_hostname" 
 : 
 string 
 , 
 "client_identifier" 
 : 
 string 
 , 
 "requested_address" 
 : 
 string 
 , 
 "client_identifier_string" 
 : 
 string 
 }
    Fields
    opcode

    enum ( OpCode )

    The BOOTP op code.
    htype

    integer ( uint32 format)

    Hardware address type.
    hlen

    integer ( uint32 format)

    Hardware address length.
    hops

    integer ( uint32 format)

    Hardware ops.
    transaction_id

    integer ( uint32 format)

    Transaction ID.
    seconds

    integer ( uint32 format)

    Seconds elapsed since client began address acquisition/renewal process.
    flags

    integer ( uint32 format)

    Flags.
    ciaddr

    string

    Client IP address (ciaddr).
    yiaddr

    string

    Your IP address (yiaddr).
    siaddr

    string

    IP address of the next bootstrap server.
    giaddr

    string

    Relay agent IP address (giaddr).
    chaddr

    string

    Client hardware address (chaddr).
    sname

    string

    Server name that the client wishes to boot from.
    file

    string

    Boot image filename.
    options[]

    object ( Option )

    List of DHCP options.
    type

    enum ( MessageType )

    DHCP message type.
    lease_time_seconds

    integer ( uint32 format)

    Lease time in seconds. See RFC2132, section 9.2.
    client_hostname

    string

    Client hostname. See RFC2132, section 3.14.
    client_identifier

    string ( bytes format)

    Client identifier. See RFC2132, section 9.14. Note: Make sure to update the client_identifier_string field as well if you update this field.

    A base64-encoded string.
    requested_address

    string

    Requested IP address. See RFC2132, section 9.1.
    client_identifier_string

    string

    Client identifier as string. See RFC2132, section 9.14. This field holds the string value of the client_identifier.

    Option

    DHCP options.

    JSON representation 
     { 
 "code" 
 : 
 integer 
 , 
 "data" 
 : 
 string 
 }
    Fields
    code

    integer ( uint32 format)

    Code. See RFC1533.
    data

    string ( bytes format)

    Data.

    A base64-encoded string.

    Http

    Specify the full URL of the HTTP request within "target". Also specify any uploaded or downloaded file information within "source" or "target".

    JSON representation 
     { 
 "method" 
 : 
 string 
 , 
 "referral_url" 
 : 
 string 
 , 
 "user_agent" 
 : 
 string 
 , 
 "response_code" 
 : 
 integer 
 , 
 "parsed_user_agent" 
 : 
 { 
 object (  UserAgentProto 
 
) 
 } 
 }
    Fields
    method

    string

    The HTTP request method (e.g. "GET", "POST", "PATCH", "DELETE").
    referral_url

    string

    The URL for the HTTP referer.
    user_agent

    string

    The User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent.
    response_code

    integer

    The response status code, for example 200, 302, 404, or 500.
    parsed_user_agent

    object ( UserAgentProto )

    The parsed user_agent string.

    Tls

    Transport Layer Security (TLS) information.

    JSON representation 
     { 
 "client" 
 : 
 { 
 object (  Client 
 
) 
 } 
 , 
 "server" 
 : 
 { 
 object (  Server 
 
) 
 } 
 , 
 "cipher" 
 : 
 string 
 , 
 "curve" 
 : 
 string 
 , 
 "version" 
 : 
 string 
 , 
 "version_protocol" 
 : 
 string 
 , 
 "established" 
 : 
 boolean 
 , 
 "next_protocol" 
 : 
 string 
 , 
 "resumed" 
 : 
 boolean 
 }
    Fields
    client

    object ( Client )

    Certificate information for the client certificate.
    server

    object ( Server )

    Certificate information for the server certificate.
    cipher

    string

    Cipher used during the connection.
    curve

    string

    Elliptical curve used for a given cipher.
    version

    string

    TLS version.
    version_protocol

    string

    Protocol.
    established

    boolean

    Indicates whether the TLS negotiation was successful.
    next_protocol

    string

    Protocol to be used for tunnel.
    resumed

    boolean

    Indicates whether the TLS connection was resumed from a previous TLS negotiation.

    Client

    Transport Layer Security (TLS) information associated with the client (for example, Certificate or JA3 hash).

    JSON representation 
     { 
 "certificate" 
 : 
 { 
 object (  Certificate 
 
) 
 } 
 , 
 "ja3" 
 : 
 string 
 , 
 "server_name" 
 : 
 string 
 , 
 "supported_ciphers" 
 : 
 [ 
 string 
 ] 
 }
    Fields
    certificate

    object ( Certificate )

    Client certificate.
    ja3

    string

    JA3 hash from the TLS ClientHello, as a hex-encoded string.
    server_name

    string

    Host name of the server, that the client is connecting to.
    supported_ciphers[]

    string

    Ciphers supported by the client during client hello.

    Certificate

    Certificate information

    JSON representation 
     { 
 "version" 
 : 
 string 
 , 
 "serial" 
 : 
 string 
 , 
 "subject" 
 : 
 string 
 , 
 "issuer" 
 : 
 string 
 , 
 "md5" 
 : 
 string 
 , 
 "sha1" 
 : 
 string 
 , 
 "sha256" 
 : 
 string 
 , 
 "not_before" 
 : 
 string 
 , 
 "not_after" 
 : 
 string 
 }
    Fields
    version

    string

    Certificate version.
    serial

    string

    Certificate serial number.
    subject

    string

    Subject of the certificate.
    issuer

    string

    Issuer of the certificate.
    md5

    string

    The MD5 hash of the certificate, as a hex-encoded string.
    sha1

    string

    The SHA1 hash of the certificate, as a hex-encoded string.
    sha256

    string

    The SHA256 hash of the certificate, as a hex-encoded string.
    not_before

    string ( Timestamp format)

    Indicates when the certificate is first valid.

    Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z" , "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30" .
    not_after

    string ( Timestamp format)

    Indicates when the certificate is no longer valid.

    Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z" , "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30" .

    Server

    Transport Layer Security (TLS) information associated with the server (for example, Certificate or JA3 hash).

    JSON representation 
     { 
 "certificate" 
 : 
 { 
 object (  Certificate 
 
) 
 } 
 , 
 "ja3s" 
 : 
 string 
 }
    Fields
    certificate

    object ( Certificate )

    Server certificate.
    ja3s

    string

    JA3 hash from the TLS ServerHello, as a hex-encoded string.

    Smtp

    SMTP info. See RFC 2821.

    JSON representation 
     { 
 "helo" 
 : 
 string 
 , 
 "mail_from" 
 : 
 string 
 , 
 "rcpt_to" 
 : 
 [ 
 string 
 ] 
 , 
 "server_response" 
 : 
 [ 
 string 
 ] 
 , 
 "message_path" 
 : 
 string 
 , 
 "is_webmail" 
 : 
 boolean 
 , 
 "is_tls" 
 : 
 boolean 
 }
    Fields
    helo

    string

    The client's 'HELO'/'EHLO' string.
    mail_from

    string

    The client's 'MAIL FROM' string.
    rcpt_to[]

    string

    The client's 'RCPT TO' string(s).
    server_response[]

    string

    The server's response(s) to the client.
    message_path

    string

    The message's path (extracted from the headers).
    is_webmail

    boolean

    If the message was sent via a webmail client.
    is_tls

    boolean

    If the connection switched to TLS.
    Design a Mobile Site
    View Site in Mobile | Classic
    Share by: