Applications Data Feed Overview

The Applications API endpoint provides descriptions, domain lists and IP network lists for defined Netify applications. You can find general Netify REST API information on Authentication, Response Codes, and other topics in the menu. You can also find hostnames, routes and specific details about the API endpoint in the API Reference Documentation.

Payload

General Information

The applications payload starts with basic information, including the ID, tag, label, and other details. The example JSON payload for Twitter is below.

Tag and ID

You can identify an application by either an ID number (e.g. 120) or by tag (e.g. netify.twitter). The "netify" prefix on the application tag is the default, so it can be omitted. For example, both netify.twitter and twitter tags identify the Twitter app. You can browse the list of IDs and tags on the applications lookup web tool or you can fetch the list by querying the REST API.

Category

Every application is listed under a primary category. You can find a list of application categories and associated IDs / tags here.

Active

Applications can come and go - merger & acquisitions, bankruptcy, etc. The active flag is set to false for any applications that have been retired.

Shared IP Detection

The network lists part of the payload provides IP sharing information (see below for details). If any IP/network used by the application is shared with another application, the shared_ip_detected flag is set to true.

"data": {
    "id": 120,
    "tag": "netify.twitter",
    "label": "Twitter",
    "full_label": "Twitter",
    "active": true,
    "shared_ip_detected": false,
    "description": "Twitter is a social ... snip ...",
    "category": {
        "id": 24,
        "tag": "social-media",
        "label": "Social Media"
    },
    "home_page": {
        "url": "https://twitter.com",
        "text": "Twitter"
    },
    ...

Logos

For data feed subscribers, the logo information is available in the data payload.

The favicon and icon can be any size, but these images will render well at the sizes described in the adjacent table. The logo, on the other hand, is strictly 128x128.

Not all applications have all of the logos available. By default, the REST API response will provide a placeholder logo showing the first letter of the app, e.g. . If you set the settings_show_default_logo parameter in the REST API request to false, the payload will not include placeholder images.

Key Description
favicon A logo that renders well at 16x16
icon A logo that renders well at 128x128
logo A logo that is exactly 128x128

Domains List

The domains list contains all the domain definitions used to detect applications. For example, the following domains (as of March 2021) are used to match the Twitter app in the Netify DPI engine:

  • t.co
  • twimg.com
  • twitter.com
  • twimg.com.akahost.net
  • twitter.map.fastly.net

These domains are matched in the Netify DPI engine against hostnames coming from TLS SNI, TLS certificate common names, HTTP headers, DNS hinting, and any hostname that pops out of the deep packet inspection engine.

For companies with large portfolios of applications, the subdomains can be important in application definitions. For example, the googleapis.com domain is part of the Google app, but the youtubei.googleapis.com domain is part of Google-owned YouTube app.

See the Domains API documentation for more information.

"domain_list": [
    {
        "id": 2737771,
        "label": "twimg.com.akahost.net",
        "category": {
            "id": 24,
            "tag": "social-media",
            "label": "Social Media"
        },
        "platform": {
            "id": 1002,
            "tag": "akamai",
            "label": "Akamai",
            "category": {
                "id": 2,
                "tag": "cdn",
                "label": "CDN"
            },
        }
    },

Networks List

Overview

The IPs and networks associated with the application are provided in the network_list part of the payload. See adjacent sample.

Detection Type

The detection_type will contain either ai or asn. Some apps are deployed on company-owned IP networks publicly registered with an autonomous system number (ASN). For example, 8.25.194.0/23 is an ASN IP block managed by Twitter.

If the detection_type is set to ai, the IP/network detection came from the Netify detection data.

"network_list": [
    {
        "network": "13.33.166.245/32",
        "version": "ipv4",
        "detection_type": "ai",
        "shared": false,
        "shared_score": 5,
        "platform": {
            "id": 1006,
            "tag": "amazon-cloudfront",
            "label": "Amazon CloudFront",
            "category": {
                "id": 2,
                "tag": "cdn",
                "label": "CDN"
            },
        }
    },

Shared IPs

It is very common for applications to use shared IPs. Here are three common shared IP scenarios:

  • Content delivery networks
  • Third party platforms, e.g. a third-party cloud-based firewall
  • Multi-app organization (e.g. YouTube and Gmail apps both use shared Google infrastructure)

The shared and shared_score provide information on IP sharing. Every IP/network is given a score from 0 (dedicated) to 100 (shared). This score is published in the shared_score field. If the score is above 50, the shared flag is set to true. Details on the scores are provided in the table below.

Score Description
0-10 Dedicated IP detected: dedicated network ASNs, IP certificate matches, reverse DNS matches.
10-20 Dedicated IP detected, high probability.
20-40 Dedicated IP detected, but possibility of sharing detected through heuristics / machine learning.
40-60 Spooky ... we don't know.
60-80 Shared IP detected, but possibility that it is dedicated.
80-90 Shared IP detected, high probability.
90-100 Shared IP detected, it's definitely in the raw Netify data.

Relations List

The relations_list data is experimental. This list provides information on applications that are interrelated. For example, a mobile game application might use Facebook to share gaming data with friends. The Netify Informatics engine uses heuristics and machine learning to detect these relationships. In this example, the Facebook app and relevant hostnames would appear in the relations_list for the mobile gaming app.

Protocol Port Stats

The protocol_port_stats data is experimental. Most apps use standard HTTP and HTTPS to communicate with server and web sites. However, IoT devices, TVs, mobile apps, and other examples use other ports and protocols. Here's an example from Blizzard's gaming app:

Protocol Port Flow Percent
HTTP TCP 80 82%
HTTPS TCP 443 11%
HTTP TCP 1119 6%
StarCraft TCP 1119 < 1%
HTTP TCP 3724 < 1%

Other Topics

Integration and Custom Solutions

Do you have any questions about integration, APIs or custom development?

Contact Us