--- title: Network Monitoring description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: Docs > DDSQL Reference > Data Directory > Network Monitoring --- # Network Monitoring This dataset represents network traffic data collected by Datadog Cloud Network Monitoring (CNM). It provides visibility into network traffic between services, containers, availability zones, and any other tag in Datadog. Connection data at the IP, port, and PID levels is aggregated into application-layer dependencies between client and server endpoints. This allows to pinpoint unexpected or latent service dependencies, optimize costly cross-regional or multi-cloud communication, identify outages of cloud provider regions and third-party tools, and troubleshoot connectivity issues. Note: This dataset can also be queried using the alias dd.network_flows. This dataset is distinct from dd.network_device_flows, which is a separate Datadog product. ``` dd.network ``` Cloud Network Monitoring Public Documentation {% icon name="icon-external-link" /%} Network Monitoring Public Documentation {% icon name="icon-external-link" /%} ## Query Parameters This dataset uses a **polymorphic table function**. You must specify parameters when querying. | Parameter | Type | Required | Description | | ---------------- | --------------- | -------- | ------------------------------------------------------------------------------------------------------------- | | `columns` | `array` | Yes | List of fields to return for each network flow (e.g., 'timestamp', 'network.client.ip', 'network.server.ip'). | | `filter` | `string` | No | Optional EVP search string. For example: filter => 'network.transport:tcp AND network.server.port:443'. | | `from_timestamp` | `string` | No | Lower time bound for the query; defaults to query context if omitted. | | `to_timestamp` | `string` | No | Upper time bound for the query; defaults to query context if omitted. | ## Example Queries ```sql -- Fetch recent network flows between services SELECT * FROM dd.network( columns => ARRAY[ 'timestamp', 'network.client.ip', 'network.server.ip', 'network.server.port', 'network.transport', 'network.bytes_read', 'network.bytes_written', 'network.rtt_avg_ns' ], filter => 'network.transport:tcp AND network.server.port:443' ) AS ( ts TIMESTAMP, client_ip VARCHAR, server_ip VARCHAR, server_port DOUBLE, transport VARCHAR, bytes_read DOUBLE, bytes_written DOUBLE, rtt_avg_ns DOUBLE ); ``` ## Fields | Title | ID | Type | Data Type | Description | | -------------------------------------- | ----------------------------------- | ---- | --------- | ------------------------------------------------------------------------------------------------ | | Timestamp | timestamp | core | timestamp | Time the network flow event was recorded in nanoseconds since epoch (e.g., 1765640709000000000). | | Flow ID | id | core | string | Unique identifier for the network flow record (e.g., 'AZsYYyOIAAACAAAANLzbc30c'). | | Source | source | core | string | Data source identifier (e.g., 'network'). | | Event Type | event_type | core | string | Type of network event (e.g., 'layer4-v2'). | | Scope Name | scope_name | core | string | Scope or data source name for the flow (e.g., 'netflow-search-v2'). | | Transport Protocol | network.transport | core | string | Transport layer protocol (e.g., 'tcp', 'udp'). | | IP Family | network.family | core | string | IP address family (e.g., 'v4', 'v6'). | | Region Communication | network.region_communication | core | string | Type of regional communication (e.g., 'intra' for same region). | | Client IP | network.client.ip | core | string | IP address of the client endpoint (e.g., '10.132.107.224'). | | Client IP Type | network.client.ip_type | core | string | Type of client IP address (e.g., 'private', 'public'). | | Client Host | network.client.host | core | string | Hostname of the client (e.g., 'i-07b6f03c87e57f2fc'). | | Client Port | network.client.port | core | int64 | Source port of the client connection (e.g., 36356). | | Client Port Count | network.client.port_count | core | int64 | Number of distinct client ports aggregated in this flow (e.g., 1). | | Server IP | network.server.ip | core | string | IP address of the server endpoint (e.g., '10.132.72.96'). | | Server IP Type | network.server.ip_type | core | string | Type of server IP address (e.g., 'private', 'public'). | | Server Host | network.server.host | core | string | Hostname of the server (e.g., 'i-024a9a501215f3a2d'). | | Server Port | network.server.port | core | int64 | Destination port of the server (e.g., 8443). | | Server Port Count | network.server.port_count | core | int64 | Number of distinct server ports aggregated in this flow (e.g., 1). | | Server PID Count | network.server.pid_count | core | int64 | Number of distinct server PIDs aggregated in this flow (e.g., 1). | | Bytes Read | network.bytes_read | core | int64 | Total bytes read by the client from the server (e.g., 24). | | Bytes Written | network.bytes_written | core | int64 | Total bytes written by the client to the server (e.g., 88). | | Packets Sent | network.packets_sent | core | int64 | Number of packets sent by the client (e.g., 9). | | Packets Received | network.packets_received | core | int64 | Number of packets received by the client (e.g., 8). | | Server Bytes Read | network.server.bytes_read | core | int64 | Total bytes read by the server from the client (e.g., 88). | | Server Bytes Written | network.server.bytes_written | core | int64 | Total bytes written by the server to the client (e.g., 24). | | Server Packets Sent | network.server.packets_sent | core | int64 | Number of packets sent by the server (e.g., 8). | | Server Packets Received | network.server.packets_received | core | int64 | Number of packets received by the server (e.g., 9). | | RTT Average (ns) | network.rtt_avg_ns | core | int64 | Average round-trip time in nanoseconds (e.g., 6542000). | | RTT Count | network.rtt_count | core | int64 | Number of RTT samples collected (e.g., 1). | | Server RTT (microseconds) | network.server.rtt | core | int64 | Server-side round-trip time in microseconds (e.g., 6542). | | Server RTT Average (ns) | network.server.rtt_avg_ns | core | int64 | Server-side average round-trip time in nanoseconds (e.g., 6542000). | | TCP Closed | network.tcp_closed | core | int64 | Number of closed TCP connections (e.g., 1). | | TCP Reset Percent | network.tcp_reset_percent | core | float64 | Percentage of connections that were reset (e.g., 0). | | TCP Refusal Percent | network.tcp_refusal_percent | core | float64 | Percentage of connections that were refused (e.g., 0). | | TCP Timeouts | network.tcp_timeouts | core | int64 | Number of TCP connection timeouts (e.g., 0). | | TCP Timeout Percent | network.tcp_timeout_percent | core | float64 | Percentage of connections that timed out (e.g., 0). | | TCP Canceled | network.tcp_canceled | core | int64 | Number of canceled TCP connections (e.g., 0). | | TCP Canceled Percent | network.tcp_canceled_percent | core | float64 | Percentage of connections that were canceled (e.g., 0). | | TCP Host Unreachable | network.tcp_host_unreachable | core | int64 | Number of host unreachable errors (e.g., 0). | | Server TCP Timeouts | network.server.tcp_timeouts | core | int64 | Number of server-side TCP connection timeouts (e.g., 0). | | Server TCP Host Unreachable | network.server.tcp_host_unreachable | core | int64 | Number of server-side host unreachable errors (e.g., 0). | | Client TCP Established | network.client.tcp_established | core | int64 | Number of client-side established TCP connections (e.g., 1). | | Client TCP Resets | network.client.tcp_resets | core | int64 | Number of client-side TCP connection resets (e.g., 0). | | Client TCP Reset Percent | network.client.tcp_reset_percent | core | float64 | Percentage of client-side connections that were reset (e.g., 0). | | Client TCP Refusals | network.client.tcp_refusals | core | int64 | Number of client-side TCP connection refusals (e.g., 0). | | Client TCP Timeouts | network.client.tcp_timeouts | core | int64 | Number of client-side TCP connection timeouts (e.g., 0). | | Intra Region | intra_region | tag | string | Whether client and server are in the same region (e.g., 'unknown'). | | Intra Availability Zone | intra_availability_zone | tag | string | Whether client and server are in the same availability zone (e.g., 'true'). | | Client Service | client_service | tag | string | Service name of the client (e.g., 'my-service'). | | Server Service | server_service | tag | string | Service name of the server. | | Client Environment | client_env | tag | string | Environment of the client (e.g., 'staging'). | | Server Environment | server_env | tag | string | Environment of the server (e.g., 'staging'). | | Client Account | client_account | tag | string | Cloud account of the client (e.g., 'staging'). | | Server Account | server_account | tag | string | Cloud account of the server (e.g., 'staging'). | | Client AWS Account | client_aws_account | tag | string | AWS account ID of the client. | | Security Group Evaluation | security_group_evaluation | tag | string | Result of security group evaluation (e.g., 'allowed', 'unknown'). | | TLS Cipher Suite | tls_cipher_suite | tag | string | TLS cipher suite used (e.g., 'tls_kds_123_gcm_sha256'). | | Client Host | client_host | tag | string | Client host identifier. | | Server Host | server_host | tag | string | Server host identifier. | | Server ADP Enabled | server_adp_enabled | tag | string | Whether Agent Data Pipeline is enabled on the server. | | Server Gateway ID | server_gateway_id | tag | string | Id of the gateway. | | Server Gateway Type | server_gateway_type | tag | string | Type of the server gateway (e.g., aws_vpc_endpoint). | | Server Kubernetes Cluster Name | server_kube_cluster_name | tag | string | Kubernetes cluster name of the server. | | Server Kubernetes Node | server_kube_node | tag | string | Kubernetes node of the server. | | Server Kubernetes Node Role | server_kube_node_role | tag | string | Kubernetes node role of the server. | | Server Kubernetes Container Name | server_kube_container_name | tag | string | Kubernetes container name of the server. | | Server Kubernetes Namespace | server_kube_namespace | tag | string | Kubernetes namespace of the server. | | Server Kubernetes Owner Reference Kind | server_kube_ownerref_kind | tag | string | Kubernetes owner reference kind of the server. | | Server Kubernetes Owner Reference Name | server_kube_ownerref_name | tag | string | Kubernetes owner reference name of the server. | | Server Kubernetes QoS | server_kube_qos | tag | string | Kubernetes Quality of Service class of the server. | | Server Kubernetes Service | server_kube_service | tag | string | Kubernetes service of the server. | | Server Kubernetes Deployment | server_kube_deployment | tag | string | Kubernetes deployment of the server. | | Server Kubernetes Replica Set | server_kube_replica_set | tag | string | Kubernetes replica set of the server. | | Server Kubernetes Priority Class | server_kube_priority_class | tag | string | Kubernetes priority class of the server (e.g., cluster-dns-critical). | | Server Kubernetes Daemon Set | server_kube_daemon_set | tag | string | Kubernetes daemon set of the server. | | Server Kubernetes Stateful Set | server_kube_stateful_set | tag | string | Kubernetes stateful set of the server. | | Server Kubernetes App Name | server_kube_app_name | tag | string | Kubernetes app name of the server. | | Server Kubernetes App Instance | server_kube_app_instance | tag | string | Kubernetes app instance of the server. | | Server Kubernetes App Managed By | server_kube_app_managed_by | tag | string | Kubernetes app managed by label of the server. | | Server Kubernetes App Component | server_kube_app_component | tag | string | Kubernetes app component of the server. | | Server Kubernetes App Part Of | server_kube_app_part_of | tag | string | Kubernetes app part of label of the server. | | Server Kubernetes App Version | server_kube_app_version | tag | string | Kubernetes app version of the server. | | Server Kubernetes Autoscaler Kind | server_kube_autoscaler_kind | tag | string | Kubernetes autoscaler kind of the server. | | Client Kubernetes Cluster Name | client_kube_cluster_name | tag | string | Kubernetes cluster name of the client. | | Client Kubernetes Node | client_kube_node | tag | string | Kubernetes node of the client. | | Client Kubernetes Node Role | client_kube_node_role | tag | string | Kubernetes node role of the client. | | Client Kubernetes Container Name | client_kube_container_name | tag | string | Kubernetes container name of the client. | | Client Kubernetes Namespace | client_kube_namespace | tag | string | Namespaces help logical separation of resources within a single cluster. | | Client Kubernetes Owner Reference Kind | client_kube_ownerref_kind | tag | string | Kubernetes owner reference kind of the client (e.g., replicaset). | | Client Kubernetes Owner Reference Name | client_kube_ownerref_name | tag | string | Kubernetes owner reference name of the client. | | Client Kubernetes QoS | client_kube_qos | tag | string | Kubernetes Quality of Service class of the client (e.g., burstable). | | Client Kubernetes Service | client_kube_service | tag | string | Kubernetes service of the client. | | Client Kubernetes Priority Class | client_kube_priority_class | tag | string | Kubernetes priority class of the client (e.g., node-local-dns-critical). | | Client Kubernetes Deployment | client_kube_deployment | tag | string | Kubernetes deployment of the client. | | Client Kubernetes Replica Set | client_kube_replica_set | tag | string | Kubernetes replica set of the client. | | Client Kubernetes Daemon Set | client_kube_daemon_set | tag | string | Kubernetes daemon set of the client. | | Client Kubernetes App Instance | client_kube_app_instance | tag | string | Kubernetes app instance of the client. | | Client Kubernetes App Name | client_kube_app_name | tag | string | Kubernetes app name of the client. | | Client Kubernetes App Managed By | client_kube_app_managed_by | tag | string | Kubernetes app managed by label of the client. | | Client Kubernetes App Component | client_kube_app_component | tag | string | Kubernetes app component of the client. | | Client Kubernetes App Part Of | client_kube_app_part_of | tag | string | Kubernetes app part of label of the client. | | Client Kubernetes Stateful Set | client_kube_stateful_set | tag | string | Kubernetes stateful set of the client. | | Client Kubernetes App Version | client_kube_app_version | tag | string | Kubernetes app version of the client. | | Client Kubernetes Autoscaler Kind | client_kube_autoscaler_kind | tag | string | Kubernetes autoscaler kind of the client. | | Client Kubernetes CronJob | client_kube_cronjob | tag | string | Kubernetes cron job of the client. | | Client Kubernetes Distribution | client_kube_distribution | tag | string | Kubernetes distribution of the client. | | Client Kubernetes Job | client_kube_job | tag | string | Kubernetes job of the client. | | Client Kubernetes Runtime Class | client_kube_runtime_class | tag | string | Kubernetes runtime class of the client. |