Application Stats Datasets
The Netify Application Stats dataset provides network intelligence data that is typically used for:
- Investigating application behavior
- Analyzing protocol and port patterns
- Extending app-based machine learning models
- Enhancing cybersecurity tools
If you are looking for streamlined application data for firewalls, routing, or QoS, the Application IPs dataset is a better option. Please look at our IPs vs Stats Guide for more information.
- See It
- Browse application data
- Learn About It
- Dataset overview
- Update Frequency
- 2 to 3 times a month
Legacy Dataset
If you subscribed to the Application Stats dataset prior to October 2024, you can access the legacy dataset here:
Dataset Samples
| Sample | Description |
|---|---|
| Root Servers | Simple IP-only example |
| Telegram | Simple network-only example |
| e-Planning | A mix of IPs and networks |
Downloads
You can find links to information on authentication, response codes, and other developer topics in the menu. An API key or token from a subscription is required to access the links below.
Payload Overview
Application Object
Every entry in the application_stats data starts with our standard application object. This provides the application name, description, logo, and other details.
Application Stats List - Overview
{
"application": { Application Attributes },
"cidr_list": [ CIDR Objects ],
"ip_list": [ IP Objects ],
"protocol_port_stats": [ Protocol Port Stats Objects ],
}CIDR List
Some applications operate across large, dedicated network blocks. For example, Telegram runs its infrastructure on networks used exclusively by the Telegram application. We include these network ranges in the cidr_list dataset because they serve only that application.
Many networks, however, support multiple applications. CDNs and hosting providers clearly fall into this category, but other enterprise networks also carry third-party traffic. For instance, Visa hosts several banking applications on its network, so we exclude parts of Visa's network blocks.
Large technology companies create similar challenges. Apple uses its network to deliver Apple TV, Apple Mail, Apple Push Notifications, and many other services. The individual applications may include parts of Apple's network in its cidr_list.
CIDR List - JSON Example
"cidr_list": [
{
"network": "9.9.9.0/24",
"version": "ipv4"
},
{
"network": "68.65.126.0/23",
"version": "ipv4"
},
...
]CIDR List Exceptions
We also apply practical exceptions to our definition of dedicated. Certain services routinely appear within otherwise dedicated ranges:
- Tor nodes are often intermixed with consumer VPNs networks.
- Speed test servers are common on dedicated application networks providing VoIP, teleconferencing, and gaming.
- NTP/time servers are ubiquitous.
We evaluate these nuances carefully when deciding which network ranges qualify for inclusion in an application's cidr_list.
IP List
The standard IP Object is used for the IPs provided in the ip_list section of the JSON payload.
The Application Stats dataset provides IP information for all known active IPs, including IPs that are part of a network (CIDR) provided in the cidr_list. This additional IP information is a major difference between the Application Stats and Application IPs datasets.
For a more detailed comparison, please read our IPs vs Stats Guide.
IP List - JSON Example
"ip_list": [
{
"address": "9.9.9.9",
"app_cidr": "9.9.9.0/24",
"shared_score": 1,
"is_anycast": true,
"rdns": {
"hostname": "dns9.quad9.net",
}
}
]Protocol Port Stats
The protocol_port_stats field provides statistics about the protocols and ports used by the application. Most apps use standard HTTP and HTTPS to communicate with servers and websites, but IoT devices, TVs, mobile apps, and others use additional ports and protocols.
| Protocol | Port | Avg bytes/flow |
|---|---|---|
| HTTPS | TCP 443 | 368,000 |
| QUIC | UDP 443 | 530,000 |
| WhatsApp Chat | TCP 443 | 19,000 |
| WhatsApp Chat | TCP 5222 | 15,000 |
| WhatsApp Call | UDP 3478 | 931,900 |
| WhatsApp Call | UDP 3482 | 41,000 |
The average bytes per flow can help identify streaming and large downloads.
Protocol Port Stats - JSON Example
"protocol_port_stats": [
{
"protocol_port": {
"ip_protocol": {
"id": 17,
"label": "UDP"
},
"protocol": {
"id": 246,
"tag": "whatsapp-call",
"label": "WhatsApp Call",
"category": {
"id": 20,
"tag": "voip",
"label": "VoIP/Conferencing"
}
},
"port": 3478
},
"stats": {
"average_bytes_per_flow": 931000
}
}
]IP Shared Score
It is very common for applications to use shared IPs. Here are three common shared IP scenarios:
- Content delivery networks
- Third party platforms, e.g. a third-party mail service
- Multi-app organizations, e.g. the YouTube and Gmail apps both use shared Google infrastructure
The shared_score provides information on IP sharing. Every IP is given a score from 0 (dedicated) to 100 (shared). Details on the scores are provided in the table below.
- -1
- Analysis has not been completed.
- 0-10
- Dedicated IP detected: dedicated network ASNs, IP certificate matches, reverse DNS matches.
- 10-20
- Dedicated IP detected, high probability.
- 20-40
- Dedicated IP detected, but possibility of sharing detected through heuristics / machine learning.
- 40-60
- Gah. This often happens when IPs are churned (dedicated to one app, then later dedicated to a different app).
- 60-80
- Shared IP detected, but possibility that it is dedicated.
- 80-90
- Shared IP detected, high probability.
- 90-100
- Shared IP detected: raw Netify intelligence data confirms sharing.