ServicesPlatformEventsEvent types

Network Flow Logs

Beta

Network Flow Logs (also referred to as flow data) capture metadata about IP traffic generated by devices across emnify’s mobile core. Use them to observe device connectivity behavior, troubleshoot issues, support security analysis, and meet audit or compliance requirements—without inspecting packet payloads or content.

Flow Logs are a subscribable enterprise service. Access them through the emnify Portal, the REST API, or stream them to external systems using Data Streamer.

Each Flow Log record describes observed IP traffic using core network attributes, including source and destination IP addresses, ports, protocol, timestamps, and traffic volume. Records also include hostname attribution and device, session, and network context (for example, organization, endpoint, APN, and serving operator) where available.

With this enrichment, you can identify not only which IP addresses your devices communicate with, but also which domains and services they contact and under which network context.

Flow Log events

Flow Log records are emitted at defined stages of a flow’s lifecycle, indicated by the event_type field:

event_typeDescription
flow_startFirst record emitted when a new flow is observed.
flow_updatePeriodic snapshot of an active flow during a reporting window.
flow_endFinal record emitted when the flow terminates, including release details.

A flow is identified by flow_id. For flow_update records, bytes_up and bytes_down are incremental values for the reporting window from period_start_ts to period_end_ts. On flow_end, the release_details object explains how and why the flow terminated.

Record fields

FieldTypeDescription
flow_idStringUnique identifier of the flow.
org_idIntegerOrganization identifier.
endpoint_idIntegerEndpoint (device) identifier.
vnet_idIntegerVirtual network identifier.
pdp_session_idStringPDP session identifier associated with the flow.
event_typeStringLifecycle stage: flow_start, flow_update, or flow_end.
directionStringTraffic direction: egress (from the device) or ingress (toward the device).
protocolIntegerIANA protocol number (for example, 6 for TCP, 17 for UDP). See protocol values.
src_ipStringSource IP address, as observed in the mobile core.
src_portIntegerSource port.
dst_ipStringDestination IP address.
dst_portIntegerDestination port.
bytes_upIntegerBytes sent by the device during the reporting window.
bytes_downIntegerBytes received by the device during the reporting window.
flow_start_tsString (RFC3339)When the flow was first observed.
period_start_tsString (RFC3339)Start of the reporting window.
period_end_tsString (RFC3339)End of the reporting window.
last_loaded_atString (RFC3339)When the record was last loaded.
nat_detailsObject or nullNAT translation details, when applicable. See Enrichment objects.
domain_nameObject or nullDestination name attribution, when available. See Enrichment objects.
pdp_contextObject or nullMobile network context, when available. See Enrichment objects.
release_detailsObject or nullFlow termination details (flow_end only). See Enrichment objects.

Enrichment objects

The following objects are present when the corresponding enrichment is available.

nat_details—NAT translation details:

FieldTypeDescription
translated_src_ipStringSource IP after NAT translation.
translated_src_portIntegerSource port after NAT translation.
public_ipStringPublic IP address after NAT translation.

domain_name—destination name attribution:

FieldTypeDescription
hostnameStringDestination hostname or domain.
sourceStringHow the hostname was attributed (for example, TLS_SNI, reverse_dns).

pdp_context—mobile network context:

FieldTypeDescription
mccStringMobile country code.
mncStringMobile network code.
apnStringAccess point name.
imsiStringInternational Mobile Subscriber Identity of the SIM.
countryObjectServing country: name, country_code, iso_code, and id.
operatorObjectServing operator: id and name.

release_details—flow termination details (flow_end only):

FieldTypeDescription
release_reasonStringWhy the flow terminated (for example, tcp_fin, tcp_rst, idle_timeout).
release_sideStringSide that initiated the termination (for example, device, network, server).

Example records

1{
2  "flow_id": "a1b2c3d4-e5f6-4890-abcd-ef0123456789",
3  "org_id": 12345,
4  "endpoint_id": 67890,
5  "vnet_id": 1,
6  "pdp_session_id": "pdp-9f3c1b27",
7  "event_type": "flow_update",
8  "direction": "egress",
9  "protocol": 6,
10  "src_ip": "100.64.0.1",
11  "src_port": 60570,
12  "dst_ip": "104.18.3.24",
13  "dst_port": 443,
14  "bytes_up": 375,
15  "bytes_down": 1154,
16  "flow_start_ts": "2026-01-15T10:55:04.731Z",
17  "period_start_ts": "2026-01-15T10:55:04.731Z",
18  "period_end_ts": "2026-01-15T10:55:16.271Z",
19  "nat_details": {
20    "translated_src_ip": "100.64.0.1",
21    "translated_src_port": 61396,
22    "public_ip": "133.7.133.7"
23  },
24  "domain_name": {
25    "hostname": "example.org",
26    "source": "TLS_SNI"
27  },
28  "pdp_context": {
29    "mcc": "262",
30    "mnc": "02",
31    "apn": "em",
32    "imsi": "262021234567890",
33    "country": { "name": "Germany", "country_code": "49", "iso_code": "de", "id": 74 },
34    "operator": { "id": "26202", "name": "Vodafone" }
35  },
36  "last_loaded_at": "2026-01-15T10:55:30.000Z"
37}
1{
2  "flow_id": "a1b2c3d4-e5f6-4890-abcd-ef0123456789",
3  "org_id": 12345,
4  "endpoint_id": 67890,
5  "vnet_id": 1,
6  "pdp_session_id": "pdp-9f3c1b27",
7  "event_type": "flow_end",
8  "direction": "egress",
9  "protocol": 6,
10  "src_ip": "10.50.12.34",
11  "src_port": 49312,
12  "dst_ip": "52.85.77.20",
13  "dst_port": 443,
14  "bytes_up": 24576,
15  "bytes_down": 262144,
16  "flow_start_ts": "2026-01-15T10:18:06.000Z",
17  "period_start_ts": "2026-01-15T10:57:41.000Z",
18  "period_end_ts": "2026-01-15T11:02:41.000Z",
19  "domain_name": {
20    "hostname": "api.example.com",
21    "source": "DNS_REPLY"
22  },
23  "pdp_context": {
24    "mcc": "262",
25    "mnc": "02",
26    "apn": "em",
27    "imsi": "262021234567890",
28    "country": { "name": "Germany", "country_code": "49", "iso_code": "de", "id": 74 },
29    "operator": { "id": "26202", "name": "Vodafone" }
30  },
31  "release_details": {
32    "release_reason": "tcp_fin",
33    "release_side": "device"
34  },
35  "last_loaded_at": "2026-01-15T11:02:55.000Z"
36}