> This page is for Home. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.emnify.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.emnify.com/_mcp/server. > Network Flow Log events in the emnify platform Network Flow Logs (also referred to as flow data) capture metadata about IP traffic generated by devices across emnify's mobile core. Use them to observe device connectivity behavior, troubleshoot issues, support security analysis, and meet audit or compliance requirements—without inspecting packet payloads or content. > **Tip** > > Flow Logs are a subscribable enterprise service. > Access them through the emnify Portal, the REST API, or stream them to external systems using Data Streamer. Each Flow Log record describes observed IP traffic using core network attributes, including source and destination IP addresses, ports, protocol, timestamps, and traffic volume. Records also include hostname attribution and device, session, and network context (for example, organization, endpoint, APN, and serving operator) where available. With this enrichment, you can identify not only which IP addresses your devices communicate with, but also which domains and services they contact and under which network context. ## Flow Log events Flow Log records are emitted at defined stages of a flow's lifecycle, indicated by the `event_type` field: | `event_type` | Description | | :------------ | :------------------------------------------------------------------------ | | `flow_start` | First record emitted when a new flow is observed. | | `flow_update` | Periodic snapshot of an active flow during a reporting window. | | `flow_end` | Final record emitted when the flow terminates, including release details. | A flow is identified by `flow_id`. For `flow_update` records, `bytes_up` and `bytes_down` are incremental values for the reporting window from `period_start_ts` to `period_end_ts`. On `flow_end`, the `release_details` object explains how and why the flow terminated. ## Record fields | Field | Type | Description | | :---------------- | :--------------- | :------------------------------------------------------------------------------------------------------------------------------------- | | `flow_id` | String | Unique identifier of the flow. | | `org_id` | Integer | Organization identifier. | | `endpoint_id` | Integer | Endpoint (device) identifier. | | `vnet_id` | Integer | Virtual network identifier. | | `pdp_session_id` | String | PDP session identifier associated with the flow. | | `event_type` | String | Lifecycle stage: `flow_start`, `flow_update`, or `flow_end`. | | `direction` | String | Traffic direction: `egress` (from the device) or `ingress` (toward the device). | | `protocol` | Integer | IANA protocol number (for example, `6` for TCP, `17` for UDP). See [protocol values](/developers/reference/flow-logs#protocol-values). | | `src_ip` | String | Source IP address, as observed in the mobile core. | | `src_port` | Integer | Source port. | | `dst_ip` | String | Destination IP address. | | `dst_port` | Integer | Destination port. | | `bytes_up` | Integer | Bytes sent by the device during the reporting window. | | `bytes_down` | Integer | Bytes received by the device during the reporting window. | | `flow_start_ts` | String (RFC3339) | When the flow was first observed. | | `period_start_ts` | String (RFC3339) | Start of the reporting window. | | `period_end_ts` | String (RFC3339) | End of the reporting window. | | `last_loaded_at` | String (RFC3339) | When the record was last loaded. | | `nat_details` | Object or null | NAT translation details, when applicable. See [Enrichment objects](#enrichment-objects). | | `domain_name` | Object or null | Destination name attribution, when available. See [Enrichment objects](#enrichment-objects). | | `pdp_context` | Object or null | Mobile network context, when available. See [Enrichment objects](#enrichment-objects). | | `release_details` | Object or null | Flow termination details (`flow_end` only). See [Enrichment objects](#enrichment-objects). | ### Enrichment objects The following objects are present when the corresponding enrichment is available. **`nat_details`**—NAT translation details: | Field | Type | Description | | :-------------------- | :------ | :--------------------------------------- | | `translated_src_ip` | String | Source IP after NAT translation. | | `translated_src_port` | Integer | Source port after NAT translation. | | `public_ip` | String | Public IP address after NAT translation. | **`domain_name`**—destination name attribution: | Field | Type | Description | | :--------- | :----- | :----------------------------------------------------------------------- | | `hostname` | String | Destination hostname or domain. | | `source` | String | How the hostname was attributed (for example, `TLS_SNI`, `reverse_dns`). | **`pdp_context`**—mobile network context: | Field | Type | Description | | :--------- | :----- | :------------------------------------------------------------- | | `mcc` | String | Mobile country code. | | `mnc` | String | Mobile network code. | | `apn` | String | Access point name. | | `imsi` | String | International Mobile Subscriber Identity of the SIM. | | `country` | Object | Serving country: `name`, `country_code`, `iso_code`, and `id`. | | `operator` | Object | Serving operator: `id` and `name`. | **`release_details`**—flow termination details (`flow_end` only): | Field | Type | Description | | :--------------- | :----- | :-------------------------------------------------------------------------------- | | `release_reason` | String | Why the flow terminated (for example, `tcp_fin`, `tcp_rst`, `idle_timeout`). | | `release_side` | String | Side that initiated the termination (for example, `device`, `network`, `server`). | ## Example records #### Example flow\_update record ```json { "flow_id": "a1b2c3d4-e5f6-4890-abcd-ef0123456789", "org_id": 12345, "endpoint_id": 67890, "vnet_id": 1, "pdp_session_id": "pdp-9f3c1b27", "event_type": "flow_update", "direction": "egress", "protocol": 6, "src_ip": "100.64.0.1", "src_port": 60570, "dst_ip": "104.18.3.24", "dst_port": 443, "bytes_up": 375, "bytes_down": 1154, "flow_start_ts": "2026-01-15T10:55:04.731Z", "period_start_ts": "2026-01-15T10:55:04.731Z", "period_end_ts": "2026-01-15T10:55:16.271Z", "nat_details": { "translated_src_ip": "100.64.0.1", "translated_src_port": 61396, "public_ip": "133.7.133.7" }, "domain_name": { "hostname": "example.org", "source": "TLS_SNI" }, "pdp_context": { "mcc": "262", "mnc": "02", "apn": "em", "imsi": "262021234567890", "country": { "name": "Germany", "country_code": "49", "iso_code": "de", "id": 74 }, "operator": { "id": "26202", "name": "Vodafone" } }, "last_loaded_at": "2026-01-15T10:55:30.000Z" } ``` #### Example flow\_end record ```json { "flow_id": "a1b2c3d4-e5f6-4890-abcd-ef0123456789", "org_id": 12345, "endpoint_id": 67890, "vnet_id": 1, "pdp_session_id": "pdp-9f3c1b27", "event_type": "flow_end", "direction": "egress", "protocol": 6, "src_ip": "10.50.12.34", "src_port": 49312, "dst_ip": "52.85.77.20", "dst_port": 443, "bytes_up": 24576, "bytes_down": 262144, "flow_start_ts": "2026-01-15T10:18:06.000Z", "period_start_ts": "2026-01-15T10:57:41.000Z", "period_end_ts": "2026-01-15T11:02:41.000Z", "domain_name": { "hostname": "api.example.com", "source": "DNS_REPLY" }, "pdp_context": { "mcc": "262", "mnc": "02", "apn": "em", "imsi": "262021234567890", "country": { "name": "Germany", "country_code": "49", "iso_code": "de", "id": 74 }, "operator": { "id": "26202", "name": "Vodafone" } }, "release_details": { "release_reason": "tcp_fin", "release_side": "device" }, "last_loaded_at": "2026-01-15T11:02:55.000Z" } ```