Network Flows Skill

Analyze network traffic in Dynatrace across three flow data sources. This skill covers the use cases network flows enable and routes each question to the right source and reference file. The detailed, source-specific DQL lives in the reference files.

What Network Flows Tell You

Network flow data answers questions that metrics and traces cannot:

• Who talks to whom — communication dependencies between hosts, processes, pods, services, and external endpoints
• Top talkers — which entities generate the most traffic, by bytes or connection count
• Connection health — resets, timeouts, retransmissions, and round-trip time (RTT) per conversation
• Traffic composition — protocol (TCP/UDP), destination ports, direction (client vs server)
• Peer resolution — mapping raw IP:port peers back to monitored entities (host, process, pod, service) or flagging them as external

The Three Flow Sources

Choose the source based on where the traffic is and what is capturing it. When more than one applies, prefer the source with the richest entity context (usually OneAgent).