Network Traffic
Security Monitoring is now available Security Monitoring is now available

Network Traffic

Traffic is always initiated by the Agent to Datadog. No sessions are ever initiated from Datadog back to the Agent:

  • All traffic is sent over SSL

  • The destination for:

    • APM data is trace.agent.datadoghq.com
    • Live Containers data is process.datadoghq.com
    • Logs data is agent-intake.logs.datadoghq.com for TCP traffic

    • All other Agent data:

      • Agents < 5.2.0 app.datadoghq.com
      • Agents >= 5.2.0 <VERSION>-app.agent.datadoghq.com

      This decision was taken after the POODLE problem. Versioned endpoints start with Agent v5.2.0, where each version of the Agent calls a different endpoint based on the version of the Forwarder. For example, Agent v5.2.0 calls 5-2-0-app.agent.datadoghq.com. Therefore you must whitelist *.agent.datadoghq.com in your firewall(s).

Since v6.1.0, the Agent also queries Datadog’s API to provide non-critical functionality (ex.: display validity of configured API key):

  • Agent >= 7.18.0/6.18.0 api.datadoghq.com
  • Agent < 7.18.0/6.18.0 app.datadoghq.com

All of these domains are CNAME records pointing to a set of static IP addresses. These addresses can be found at:

  • All traffic is sent over SSL

  • The destination for:

    • APM data is trace.agent.datadoghq.eu
    • Live Containers data is process.datadoghq.eu
    • Logs data is agent-intake.logs.datadoghq.eu for TCP traffic

    • All other Agent data:

      • Agents < 5.2.0 app.datadoghq.eu
      • Agents >= 5.2.0 <VERSION>-app.agent.datadoghq.eu

      This decision was taken after the POODLE problem. Versioned endpoints start with Agent v5.2.0, where each version of the Agent calls a different endpoint based on the version of the Forwarder. For example, Agent v5.2.0 calls 5-2-0-app.agent.datadoghq.com. Therefore you must whitelist *.agent.datadoghq.eu in your firewall(s).

Since v6.1.0, the Agent also queries Datadog’s API to provide non-critical functionality (ex.: display validity of configured API key):

  • Agent >= 7.18.0/6.18.0 api.datadoghq.eu
  • Agent < 7.18.0/6.18.0 app.datadoghq.eu

All of these domains are CNAME records pointing to a set of static IP addresses. These addresses can be found at:

The information is structured as JSON following this schema:

{
    "version": 1,                       // <-- incremented every time this information is changed
    "modified": "YYYY-MM-DD-HH-MM-SS",  // <-- timestamp of the last modification
    "agents": {                         // <-- the IPs used by the Agent to submit metrics to Datadog
        "prefixes_ipv4": [              // <-- list of IPv4 CIDR blocks
            "a.b.c.d/x",
            ...
        ],
        "prefixes_ipv6": [              // <-- list of IPv6 CIDR blocks
            ...
        ]
    },
    "apm": {...},                       // <-- same structure as "agents" but IPs used for the APM Agent data
    "logs": {...},                      // <-- same for the logs Agent data
    "process": {...},                   // <-- same for the process Agent data
    "api": {...},                       // <-- same for non-critical Agent functionality (querying informaton from API)
    "webhooks": {...}                   // <-- not used for Agent traffic (Datadog source IPs delivering webhooks)
}

Each section has a dedicated endpoint at, for example:

Each section has a dedicated endpoint, for example:

Note

You should whitelist all of these IPs. While only a subset are active at any given moment, there are variations over time within the entire set due to regular network operation and maintenance.

Open Ports

All outbound traffic is sent over SSL via TCP / UDP.

Open the following ports in order to benefit from all the Agent functionalities:

    • Outbound:

    • Inbound:

      • 8125/udp: DogStatsd. Unless non_local_traffic is set to true. This port is available on localhost:

        • 127.0.0.1
        • ::1
        • fe80::1

      • 8126/tcp: port for the APM Receiver

      • 17123/tcp: Agent forwarder, used to buffer traffic in case of network splits between the Agent and Datadog

      • 17124/tcp: optional graphite adapter

    Using Proxies

    For a detailed configuration guide on proxy setup, see Agent Proxy Configuration.

    Further Reading

    Additional helpful documentation, links, and articles:

    Collect your logsDOCUMENTATION more more Collect your processesDOCUMENTATION more more Collect your tracesDOCUMENTATION more more
    edit Edit

    On this Page