Cadres IT Operations & Infrastructure
Products Architecture Docs Blog
Sheet SYN-11 Rev 2026.08
Start Trial

Sheet SYN-11 · Network Operations Manual

Traffic Visibility

Traffic analysis from flow export: the traffic dashboard, exporter-to-site mapping, collector flow mode, and retention.

Audience: Network operators answering bandwidth questions Focus: Who talked to whom, without agents

Scope

Traffic visibility uses the flow data your network devices already export to show, hour by hour, who talked to whom and how much. No agent is installed on any endpoint and no packets are captured. The collector receives the NetFlow, IPFIX, or sFlow export your devices send. This guide covers the dashboard, exporter mapping, and setup.

The traffic dashboard

Pick a site (or all sites) and a window of 24 hours, 7 days, or 30 days. The dashboard has three tabs:

  • Overview. A ring chart of traffic by service (identified from well-known ports) or by protocol. The top ten groups show individually and the rest are combined as “other”. Total bytes for the window appear in the center.
  • Conversations. The busiest conversations: client subnet, server and port, service, bytes, and flow count. You can export the rows to CSV.
  • Flow diagram. Client subnets on one side and servers and services on the other, with ribbons sized by bytes. It shows only the busiest conversations and states the limit.

Client subnets only

Traffic views show client subnets, never individual client hosts. The collector drops host detail before any data leaves the site, for privacy and to limit data volume.

Exporter mapping

Each device that sends flow data to the collector appears as an exporter, identified by IP address. New exporters are unmapped and flagged for an administrator. Mapping an exporter to a site assigns all its recorded conversations to that site, including traffic recorded before the mapping. Unmapping reverses this. Unmapped traffic still appears in the account-wide view.

Setup

Two steps per site:

  1. Turn on flow mode on the site’s collector. The collector used for configuration backup then listens on a UDP port for flow export. This is the only collector feature that needs an inbound firewall rule.
  2. Configure the site’s routers, switches, and firewalls to export flows to the collector, using each vendor’s standard flow-export settings.

Exporters appear within minutes of the first flows arriving.

Retention

Every tenant keeps at least 14 days of traffic data. Plans with a longer retention entitlement get the longer window automatically.