Flow Stats Telemetry

The Flow Stats telemetry provides periodic runtime statistics for active flows, especially long-lived sessions such as streaming, VPN, and persistent service connections. It complements flow metadata by reporting ongoing packet, byte, and rate counters while a flow remains active.

This record is most valuable for near-real-time monitoring and QoE analysis. Tracking directional throughput and TCP health metrics over time helps detect performance degradation, congestion, and retransmission-related issues before a flow is closed.

Requirements

Install and configure the Netify Agent
Install and configure a Sink Plugin for receiving the telemetry
Install and configure the Core Plugin and add stream-flows to types

Source: Core Plugin
Plugin Release: 1.0.20

Optimizations

Local Rate

The local_rate is a burst rate, not a sustained average. Within a standard 15-second stats interval, a 1-second flow will report its full bandwidth for that second, not the full 15-second interval. Here are some considerations:

Volatility: Rates calculated over short durations are statistically noisy and easily misinterpreted. Use this data knowing it reflects peak intensity, not long-term trends.
Non-Additive: Because local_rate represents a burst, you cannot sum it across multiple flows. Doing so will create an inaccurate "phantom" total.

Visualization Best Practice: Avoid standard line charts which can become noisy. Use heatmaps or scatterplots to identify outliers, and always provide actual bandwidth for context.

Attributes

flow

object

Container for per-flow live statistics.

flow.detection_packets

integer

Number of packets used for application/protocol detection.

flow.digest

string

Current flow digest identifier.

flow.digest_prev

array

List of previous digest identifiers associated with the flow.

flow.last_seen_at

integer

Timestamp in Unix epoch milliseconds when the flow was last observed.

flow.local_bytes

integer

Bytes sent from the local endpoint.

flow.local_packets

integer

Packets sent from the local endpoint.

flow.local_rate

integer

Current local transmit rate for the flow.

flow.other_bytes

integer

Bytes sent from the remote endpoint.

flow.other_packets

integer

Packets sent from the remote endpoint.

flow.other_rate

integer

Current remote transmit rate for the flow.

flow.total_bytes

integer

Total bytes seen for the flow in both directions.

flow.total_packets

integer

Total packets seen for the flow in both directions.

flow.tcp

object

TCP health and error counters. Omitted for non-TCP flows.

flow.tcp.resets

integer

Count of observed TCP reset packets for the flow.

flow.tcp.retrans

integer

Count of observed TCP retransmissions for the flow.

flow.tcp.seq_errors

integer

Count of TCP sequence anomalies for the flow.

interface

string

Interface name associated with the flow update.

internal

boolean

Indicates whether this flow is internal to the local network context.

type

string

Telemetry record type. Always flow_stats.

Flow Stats Attributes - Example

{
  "flow": {
    "detection_packets": 2,
    "digest": "c3086c57745b...",
    "digest_prev": [
      "fcd1061d4c2ba844..."
    ],
    "last_seen_at": 1772665318561,
    "local_bytes": 5559,
    "local_packets": 6,
    "local_rate": 5559,
    "other_bytes": 913,
    "other_packets": 6,
    "other_rate": 913,
    "tcp": {
      "resets": 0,
      "retrans": 0,
      "seq_errors": 0
    },
    "total_bytes": 613175,
    "total_packets": 1064
  },
  "interface": "wlp3s0",
  "internal": true,
  "type": "flow_stats"
}