Network Traffic

The Network Traffic object represents arbitrary network traffic that originates from a source and is addressed to a destination. The network traffic MAY or MAY NOT constitute a valid unicast, multicast, or broadcast network connection. This MAY also include traffic that is not established, such as a SYN flood.

To allow for use cases where a source or destination address may be sensitive and not suitable for sharing, such as addresses that are internal to an organization’s network, the source and destination properties (src_ref and dst_ref, respectively) are defined as optional in the properties table below. However, a Network Traffic object MUST contain the protocols property and at least one of the src_ref or dst_ref properties and SHOULD contain the src_port and dst_port properties.

• TODO: Add examples

Properties

Property	Type	Description
typeoptional	string	The value of this property MUST be `network-traffic`.
extensionsoptional		The Network Traffic Object defines the following extensions. In addition to these, producers MAY create their own. Extensions: http-ext, tcp-ext, icmp-ext, socket-ext
startoptional	string	Specifies the date/time the network traffic was initiated, if known.
endoptional	string	Specifies the date/time the network traffic ended, if known.
src_refoptional	string	Specifies the source of the network traffic, as a reference to an Observable Object.
dst_refoptional	string	Specifies the destination of the network traffic, as a reference to an Observable Object.
src_portoptional	integer	Specifies the source port used in the network traffic, as an integer. The port value MUST be in the range of 0 - 65535.
dst_portoptional	integer	Specifies the destination port used in the network traffic, as an integer. The port value MUST be in the range of 0 - 65535.
protocolsrequired	list of string	Specifies the protocols observed in the network traffic, along with their corresponding state.
src_byte_countoptional	integer	Specifies the number of bytes sent from the source to the destination.
dst_byte_countoptional	integer	Specifies the number of bytes sent from the destination to the source.
src_packetsoptional	integer	Specifies the number of packets sent from the source to the destination.
dst_packetsoptional	integer	Specifies the number of packets sent destination to the source.
ipfixoptional		Specifies any IP Flow Information Export (IPFIX) data for the traffic.
src_payload_refoptional	string	Specifies the bytes sent from the source to the destination.
dst_payload_refoptional	string	Specifies the bytes sent from the source to the destination.
encapsulates_refsoptional	list of string	Links to other network-traffic objects encapsulated by a network-traffic.
encapsulated_by_refoptional	string	Links to another network-traffic object which encapsulates this object.