Netify Data Feed - Application Stats

Application Stats Datasets

The Netify Application Stats dataset provides network intelligence data that is typically used for:

Investigating application behavior
Analyzing protocol and port patterns
Managing geographic app performance
Extending app-based machine learning models
Enhancing cybersecurity tools

The dataset provides network blocks, detailed IP information, and protocol/port information for all the applications supported by Netify. The dataset is updated two to three times a month.

If you are looking for streamlined application data for firewalls, routing, or QoS, the Application IPs dataset is a better option. Please look at our Application IPs vs Stats Guide for more information.

Learn More Browse Applications

Dataset Samples

Sample	Description
Root Servers	Simple IP-only example
Telegram	Simple network-only example
e-Planning	A mix of IPs and networks

Get Started

We have a number of available subscription options to meet your needs. If you have a specific requirement for the data, please do not hesitate to contact us

Available Subscriptions

Legacy Dataset

If you subscribed to the Application Stats dataset prior to October 2024, you can access the legacy dataset here:

Application Stats

API Quick Reference

You can find links to information on authentication, response codes, data formats, and other developer topics in the menu. An API key or token from a subscription is required to access the links below.

Per Application - JSON	https://feeds.netify.ai/datasets/v2/application_stats/{application_tag}.json.gz e.g.: https://feeds.netify.ai/datasets/v2/application_stats/reddit.json.gz

You can fetch the list of application tags from the following API endpoint:
https://feeds.netify.ai/api/v2/lookup/applications

Some applications use tens of thousands of server IP addresses to deliver images, videos, and metadata. Payloads can be up to 100 MB per application, so we do not provide an index for this endpoint.

Data Payload

Application Property

The Netify Application Stats feed starts with our standard application property. This property provides the application name, description, logo, and other details.

JSON Overview

{
    { Application Property },
    [ CIDR List ],
    [ IP List ],
    [ Protocol Port Stats ],
}

CIDR List

Some applications run across large network blocks. For example, Microsoft Teams connects to specific network blocks for video conferencing. In these cases, the cidr_list property will appear in the dataset.

The networks provided in the cidr_list are dedicated to serving the application and only the application. For example, the networks for Telegram are only used by the Telegram app, so these are listed in the cidr_list data.

Many networks are used to host other applications. CDNs and hosting providers certainly fall into this category, but other networks also host third-party traffic. For example, a handful of banking apps are hosted on the Visa network. In this case, many (or all) of the network blocks for Visa are not included in Visa's cidr_list.

Large companies that provide many applications fall under the same situation as Visa. Apple's network, for example, is used by Apple TV, Apple Mail, Apple Push, and many others.

CIDR List - JSON Example

"cidr_list": [
    {
        "network": "9.9.9.0/24",
        "version": "ipv4"
    },
    {
        "network": "68.65.126.0/23",
        "version": "ipv4"
    },
    ...
]

And just to add some complexity, we make some exceptions to what is considered "dedicated". A few applications can pop-up on what is generally a dedicated network:

Tor exit nodes are often intermixed with consumer VPNs network ranges.
Speed test servers are common on applications providing VoIP, teleconferencing, and gaming.
NTP servers are ubiquitous.

IP List

The standard IP Object is used for the IPs provided in the ip_list section of the JSON payload.

The Application Stats dataset provides IP information for all known active IPs, including IPs that are part of a network (CIDR) provided in the above cidr_list. For example, Quad9's 9.9.9.9 DNS server is part of Quad9's 9.9.9.0/24 application networks (CIDRs). The additional IP information is a major difference between the Application Stats and Application IPs datasets. Please read our IPs vs Stats Guide for more information.

ProTip: The app_cidr property (shown below) appears in the standard IP Object when the IP address is included in application network (CIDR) range - 9.9.9.0/24 in our Quad9 example below.

"ip_list": [
    {
        "address": "9.9.9.9",
        "app_cidr": "9.9.9.0/24",
        "shared_score": 1,
        "is_anycast": true,
        "rdns": {
            "hostname": "dns9.quad9.net",
            ...
        }
        ...
    },
    ...
]

Protocol Port Stats

The protocol_port_stats field provides statistics about the protocols and ports used by the application. Most apps use standard HTTP and HTTPS to communicate with servers and websites. However, IoT devices, TVs, mobile apps, and others use other ports and protocols. Here's an example for WhatsApp:

Protocol	Port	Avg bytes/flow
HTTPS	TCP 443	368,000
QUIC	UDP 443	530,000
WhatsApp Chat	TCP 443	19,000
WhatsApp Chat	TCP 5222	15,000
WhatsApp Call	UDP 3478	931,900
WhatsApp Call	UDP 3482	41,000

The average bytes per flow can help identify streaming and large downloads.

Note: the statistics do not include details on ephemeral ports. For example, WhatsApp uses a random port to establish peer-to-peer connections. This type of application detection requires Netify DPI.

"protocol_port_stats": [
  {
    "protocol_port": {
      "ip_protocol": {
        "id": 17,
        "label": "UDP"
      },
      "protocol": {
        "id": 246,
        "tag": "whatsapp-call",
        "label": "WhatsApp Call",
        "category": {
          "id": 20,
          "tag": "voip",
          "label": "VoIP/Conferencing"
        }
      },
      "port": 3478
    },
    "stats": {
      "average_bytes_per_flow": 931000
    }
  },
  ...
]