Cadres IT Operations & Infrastructure
Products Architecture Docs Blog
Sheet SYN-11 Rev 2026.08
Start Trial

Sheet SYN-11 — Network Operations Manual

Traffic Visibility

Flow-export traffic analysis: the traffic dashboard, exporter-to-site mapping, collector flow mode, and retention.

Audience: Network operators answering bandwidth questions Focus: Who talked to whom, without agents

Scope

Traffic visibility turns the flow metadata network devices already export into an hourly picture of who talked to whom and how much. No agent is installed on any endpoint and no packets are captured; the collector passively receives the NetFlow, IPFIX, or sFlow export the gear already emits. This guide covers the dashboard, exporter mapping, and setup.

The traffic dashboard

A site selector (or all sites) and a time window of 24 hours, 7 days, or 30 days scope three tabs:

  • Overview. A ring chart of traffic grouped by service (resolved from well-known ports) or by protocol, showing the top ten groups individually with everything else folded into a single other slice, and the window’s total bytes in the center.
  • Conversations. The busiest individual conversations: client subnet, server and port, resolved service, bytes, and flow count, with a CSV export of the same rows.
  • Flow diagram. Client subnets on one side, servers and services on the other, with ribbons sized by bytes moved, capped to the busiest conversations with the cap always shown.

Client subnets, not client hosts

Synapse never tracks or displays individual client hosts in the traffic views, only their subnet. This is a deliberate privacy and scale choice made at the collector, before any data reaches the cloud.

Exporter mapping

Every exporting device the collector hears from appears as an exporter, identified by IP, and starts unmapped. Unmapped exporters are visually flagged as the administrator’s to-do list. Confirming an exporter against a site retroactively attributes every conversation already recorded to that site, so history captured before the mapping becomes visible immediately. Unmapping reverses this. Unmapped traffic remains visible in the account-wide view.

Turning it on

Two steps per site:

  1. Enable flow mode on the site’s collector. The same enrolled collector used for configuration backup listens on a UDP port for flow export. This is the one collector capability that needs an inbound allowance.
  2. Point the site’s routers, switches, and firewalls at the collector. Standard vendor flow-export configuration on the device side.

Exporters appear within minutes of flows arriving.

Retention

Every tenant keeps a base retention window of at least 14 days, and a plan with a larger retention entitlement gets the larger window automatically. Retention only ever gets longer with a better plan.