Network Monitoring

Analyze traffic flows, detect anomalous patterns, and monitor protocol distribution across virtual and physical networks.

Overview

The nxtRadar Network Traffic Monitoring module provides deep visibility into traffic flows, bandwidth consumption, and protocol distribution across your virtual and physical networks. Operations teams use it to identify top bandwidth consumers, investigate anomalous patterns, and baseline normal network behavior.

Prerequisites

• An active NxtSight account with project access
• Network flow collection configured by your administrator (see nxtRadar Admin — Agent Configuration)

---

Network Traffic Views

Dashboard

Navigate to Monitor Center > Monitoring (Network section, admin view) to access network monitoring views.

View	Shows
Traffic Overview	Total inbound/outbound traffic per interface over time
Top Talkers	Highest-bandwidth source/destination pairs
Protocol Analysis	Traffic breakdown by protocol (TCP, UDP, ICMP, application layer)
Flow Table	Individual network flows with source, destination, port, and bytes
Anomaly Detection	Unusual traffic patterns flagged by behavioral analysis

Set the Scope filter to a specific project, network, or subnet to isolate traffic for a particular project or application tier.

CLI

Get top bandwidth consumers (last 1h)

nxtradar network top-talkers --period 1h --limit 10

Show traffic for a specific host

nxtradar network flows --host 10.0.1.50 --from now-24h

Export flow data

nxtradar network export \
  --network prod-tenant-net \
  --from 2026-03-17T00:00 \
  --to 2026-03-17T23:59 \
  --output flows-2026-03-17.csv

---

Analyzing Traffic Anomalies

1. Review the Anomaly Detection panel

   Navigate to Monitor Center > Monitoring (Network Anomaly, admin view). nxtRadar uses behavioral baselines to flag traffic patterns that deviate significantly from historical norms.

   Each anomaly entry shows:

   • Detection time and duration
   • Affected host or network segment
   • Anomaly type (volumetric, port scan, protocol violation, etc.)
   • Confidence score
2. Drill into suspicious flows

   Click on an anomaly event to view the associated flow records. Use the Flow Table to examine individual connections:

   Column	Description
   Source IP	Originating IP address
   Destination IP	Target IP address
   Port	Destination port
   Protocol	TCP, UDP, ICMP
   Bytes	Total data transferred in this flow
   Duration	Flow lifetime in seconds

3. Correlate with logs

   Cross-reference suspicious traffic with log events in the Log Explorer:

   host:<SUSPICIOUS_IP> level:ERROR
   

   Combined network flow data and log events often confirm whether an anomaly is malicious or benign (e.g., a legitimate backup job generating unusual burst traffic).

   Use nxtRadar’s Linked Panels feature to open the Log Explorer pre-filtered to the host and time range of a network anomaly with a single click.

---

Setting Network Traffic Alerts

Alert on network conditions that indicate problems or security events:

Bandwidth Threshold Alert

Navigate to Monitor Center > Monitoring (Create Alert Rule, admin view):

Field	Value
Metric	NxtSight_network_interface_rx_bytes
Condition	>
Threshold	900000000 (900 MB/s — 90% of 1 GbE)
Evaluation Period	5 minutes
Severity	Warning

Packet Loss Alert

alert-packet-loss.yaml

name: high-packet-loss
metric: NxtSight_network_packet_loss_pct
condition: ">"
threshold: 1
evaluation_period: 5m
severity: critical
notification_channels:
  - ops-email

Create alert

nxtradar alert rule create --file alert-packet-loss.yaml

---

Next Steps

Metrics & Alerts

Create bandwidth and packet loss alert rules

Log Analytics

Correlate network anomalies with log events from the same time window

Alert Rules (Advanced)

Configure compound alert conditions and escalation for network events

nxtRadar Admin — DDoS Protection

Configure automatic DDoS mitigation policies (administrator)