Network Traffic
================================

Enabling Netflow Agent
----------------------

Genian |product_name| can monitor network traffic by utilizing the Netflow Agent function
of a sensor. This flow information of connected devices provides enhanced Network
Observability which is a crucial component for enforcing |product_name| policies. Once enabled,
the Netflow Agent will log flows of all traffic flowing through the sensor. 
Information logged in flows includes but is not limited to:

-  **Source IP Address**
-  **Destination IP Address**
-  **Protocol (UDP/TCP)**
-  **Source Port**
-  **Destination Port**
-  **Application**
-  **Geolocation Data**
-  **User (which user the flows are associated with)**
-  **Number of Packets**
-  **Number of Bytes**
-  **Flow Start (date/time)**
-  **Flow End (date/time)**

.. note:: In order to see flows utilizing the Netflow Agent, traffic from an endpoint must be flowing through a network sensor.  To route traffic through a sensor, following the instructions below to deploy a cloud gateway and |product_name| client.

:doc:`Managing Nodes in the Cloud</monitoring/cloud>`

:doc:`Controlling Access to Cloud Resources</controlling/controlling-cloudaccess>`

To enable the Netflow Agent on the network sensor:

#. Go to **System > Sensor** in the top panel
#. Click on **Edit Sensor Settings** for the tap_1 sensor interface
#. Scroll down to **Traffic Monitoring** section and toggle **Netflow Agent** to **On**
#. Click **Update** at the bottom of the page

To test and validate that flow data is being collected and logged:

#. Go to **Log > Flow** in the top panel
#. Flows should be populated for any traffic routing through the network sensor

.. note:: Only flows for connected |product_name| clients will be logged. 

To view connected |product_name| clients:

#. Go to **System > Site** in the top panel
#. Under the |product_name| - Client column, click on the **(*)** link to view connected clients
#. Flows from these clients should be visible in the flow logs

To view summary information for flow data:

#. Go to **Dashboard** in the top panel
#. Click on **Flow Data** tab in Dashboard
#. View various widgets including Top Traffic by Source IP, Destination IP, User, etc.