What are service fields? about elastiflow HOT 2 CLOSED

While flow data (and other sources) provide source and destination IP addresses and ports, this is not usually how users think about network connections. Your question about http/https is a perfect example...

When your browser requests a web page it will send the request to the destination IP and port (e.g. 80) of the web server, while opening a random source port (usually a higher numbered port, for our example let's use 37777) on which it will listen for the response from the web server. So for the request to the web server we will have...

src_ip: IP_OF_BROWSER
src_port: 37777
dst_ip: IP_OF_WEBSERVER
dst_port: 80

When the webserver responds, the traffic is going the other way. So the web server is the source, and the browser is the destination. This means that the flows for the responses will be flipped around...

src_ip: IP_OF_WEBSERVER
src_port: 80
dst_ip: IP_OF_BROWSER
dst_port: 37777

This isn't how many people think about network traffic. Instead they think of the "server" as web server, the "client" as the browser and the "service" as HTTP. ElastiFlow uses a simple algorithm, based on IANA registered service names, to guess which end of the connection is the client and which is the server. It isn't always correct (you really need packet capture of session initiation to be 100% accurate) but it does a pretty good job in most cases.

This allows the data to be presented and analysed from the client/server perspective, rather than src/dest. The source and destination data is still there, so you have that option if you need it.

from elastiflow.

Thanks a lot for the explanation!

from elastiflow.