Flow Stats Telemetry

The Flow Stats telemetry provides periodic runtime statistics for active flows, especially long-lived sessions such as streaming, VPN, and persistent service connections. It complements flow metadata by reporting ongoing packet, byte, and rate counters while a flow remains active.

This record is most valuable for near-real-time monitoring and QoE analysis. Tracking directional throughput and TCP health metrics over time helps detect performance degradation, congestion, and retransmission-related issues before a flow is closed.

Requirements

Install and configure the Netify Agent
Install and configure a Sink Plugin for receiving the telemetry
Install and configure the Core Plugin and add stream-flows to types

Source: Core Plugin
Plugin Release: 1.0.20

Optimizations

Purge Stats

For Netify Agent v5.2.x or lower, you also need to add the Flow Purge record to complete the stats for a flow.

Rates

local_rate/other_rate are the local device's rates for the flow, in bytes per second. Both are averages over roughly the last 60 seconds, independent of the statistics interval. A 15-second interval still reports an average over about the previous minute. Keep the following in mind:

Short flows use their actual age. A flow younger than 60 seconds is averaged over its lifetime, not a full minute. A flow that sends 1 MB in its first second reports about 1 MB/s, so short-lived flows can still show high rates.
Idle directions retain their last rate. A rate updates only when data moves in that direction. If traffic stops, the previous value remains.
Do not sum rates across flows. Short flows and stale idle values can overstate throughput.

Visualization Best Practice: For local_rate/other_rate, use heat maps or scatter plots to identify outliers, and always provide actual bandwidth for context.

Attributes

flow

object

Container for per-flow live statistics.

flow.detection_packets

integer

Number of packets used for application/protocol detection.

flow.digest

string

Current flow digest identifier.

flow.digest_prev

array

List of previous digest identifiers associated with the flow.

flow.last_seen_at

integer

Timestamp in Unix epoch milliseconds when the flow was last observed.

flow.local_bytes

integer

Bytes sent from the local endpoint.

flow.local_packets

integer

Packets sent from the local endpoint.

flow.local_rate

integer

Current local transmit rate for the flow.

flow.other_bytes

integer

Bytes sent from the remote endpoint.

flow.other_packets

integer

Packets sent from the remote endpoint.

flow.other_rate

integer

Current remote transmit rate for the flow.

flow.total_bytes

integer

Total bytes seen for the flow in both directions.

flow.total_packets

integer

Total packets seen for the flow in both directions.

flow.tcp

object

TCP health and error counters. Omitted for non-TCP flows.

flow.tcp.resets

integer

Count of observed TCP reset packets for the flow.

flow.tcp.retrans

integer

Count of observed TCP retransmissions for the flow.

flow.tcp.seq_errors

integer

Count of TCP sequence anomalies for the flow.

interface

string

Interface name associated with the flow update.

internal

boolean

Indicates whether this flow is internal to the local network context.

type

string

Telemetry record type. Always flow_stats.

Flow Stats Attributes - Example

{
  "flow": {
    "detection_packets": 2,
    "digest": "c3086c57745b...",
    "digest_prev": [
      "fcd1061d4c2ba844..."
    ],
    "last_seen_at": 1772665318561,
    "local_bytes": 5559,
    "local_packets": 6,
    "local_rate": 5559,
    "other_bytes": 913,
    "other_packets": 6,
    "other_rate": 913,
    "tcp": {
      "resets": 0,
      "retrans": 0,
      "seq_errors": 0
    },
    "total_bytes": 613175,
    "total_packets": 1064
  },
  "interface": "wlp3s0",
  "internal": true,
  "type": "flow_stats"
}