Top network connections
0readings
0conditions
0themes fed
Livestatus
TCP payload traffic leaders by process and destination, with measured local and internet remainders.
Topic id: top_network_connections.
Reported every 5 minutes on clock boundaries for the window ending at t. sparklogs.window_coverage_pct is below 100 when collection covered only part of the window. Use chart buckets at least 5 minutes wide.
Fields
Five-minute TCP payload totals and rates from measured intervals, with retransmission share and RTT when measured. Public destinations follow the effective full, prefix, opaque or aggregate privacy mode; local-use translation addresses remain prefix-masked. Direction and verified process identity fields are omitted when unavailable or merged contributors disagree. Local and internet remainders retain measured traffic outside listed rows; UDP and QUIC are not attributed.
| Field | Type | Unit | Meaning |
|---|---|---|---|
sparklogs.data.top_network_connections.connection | string | TCP connection label, using only the effective destination projection. Local endpoint is left; -> means inferred outbound, <- inferred inbound, -- unknown direction. The sole row key. | |
sparklogs.data.top_network_connections.entry_kind | string | connection, process_internet (public process/port aggregate), or remainder (one per scope). TCP only; UDP and QUIC are not attributed. | |
sparklogs.data.top_network_connections.transport | string | Transport measured by these rows: tcp. | |
sparklogs.data.top_network_connections.top_by | string_array | Rankings selecting this row: rx and tx each select ten nonzero leaders; total fills up to forty rows above the materiality floor; since 1.14.2, unhealthy selects up to five more among the rest and also tags a row the others selected. Since 1.14.3 unhealthy means, over the window, at least one retransmit timeout (tcp_timeouts) or a tcp_retransmit_pct_avg of at least 2 with at least 64 KiB sent (duplicate-ACK episodes no longer count); the five are ranked by timeouts, then that share. A connection that closed within the window is still a candidate for every ranking, kept by its own rank among closed ones, so a process_internet aggregate counts only its kept closed connections and the scope remainder holds the rest. Empty on remainders. | |
sparklogs.data.top_network_connections.direction | string | inbound or outbound, inferred from same-process listening ports at admission. Absent when listener evidence is unavailable or merged contributors disagree. | |
sparklogs.data.top_network_connections.scope | string | internet or local, using the TCP sampler's public-address classification. | |
sparklogs.data.top_network_connections.family | string | Socket address family: ipv4 or ipv6, preserved even when prefix projection folds an embedded IPv4 address. Absent on aggregates and remainders. | |
sparklogs.data.top_network_connections.pid | integer | PID reported by the TCP table. Absent on remainders and when merged contributors disagree. No process metadata is joined by PID alone. Kernel-mode servers can attribute to System. | |
sparklogs.data.top_network_connections.create_time_ts | string | timestamp | Verified process creation time, RFC3339 UTC. Absent when identity was not established or merged owners disagree. |
sparklogs.data.top_network_connections.image_name | string | Executable name from the verified process identity, when available and agreed by every merged contributor; since 1.14.3 whenever the process list knows the process, also when it learned of it after the connection was first seen. Where absent, a reader takes the basename of image_path, as top_processes does. | |
sparklogs.data.top_network_connections.image_path | string | Normalized executable path from the verified process identity. Absent when unavailable or merged owners disagree. No command-line arguments. | |
sparklogs.data.top_network_connections.local_address | string | Device endpoint address, including an IPv6 scope identifier when present. Absent on process aggregates and remainders. | |
sparklogs.data.top_network_connections.local_port | integer | Local TCP port; on inbound aggregates, the inferred listening port. Absent on outbound or unknown-direction aggregates and remainders. | |
sparklogs.data.top_network_connections.remote_address | string | Exact local-scope address, or public address under full, prefix or opaque projection. Absent on process aggregates and remainders. | |
sparklogs.data.top_network_connections.remote_port | integer | Remote TCP port; on outbound aggregates, the service port. Absent on inbound or unknown-direction aggregates and remainders. | |
sparklogs.data.top_network_connections.connections | integer | Distinct retained connections with nonzero accepted TCP contributions, including RTT-only contributions; all-zero connections do not contribute. Remainders omit this: scope totals include discarded, replaced and detail-cap entries without an exact distinct count. The detail cap is twice the effective tracking cap. When full, entries below the configured materiality floor over accepted seconds may be evicted; readmission starts fresh. Above the tracking cap, network_path reports census and stable-hash sample coverage. | |
sparklogs.data.top_network_connections.rx_bytes_5m | integer | bytes | TCP payload bytes received over accepted intervals, never scaled to a full window. Under Detail pressure, aggregate and per-connection rows count retained contributions only; scope remainders conserve the omitted bytes. |
sparklogs.data.top_network_connections.tx_bytes_5m | integer | bytes | TCP payload bytes sent over accepted intervals, including retransmitted payload, not goodput. Never scaled. Under Detail pressure, aggregate and per-connection rows count retained contributions only; scope remainders conserve the omitted bytes. |
sparklogs.data.top_network_connections.rx_bytes_per_s_avg | float | bytes_per_second | Received payload bytes divided by TCP measured seconds for this window. |
sparklogs.data.top_network_connections.tx_bytes_per_s_avg | float | bytes_per_second | Sent payload bytes divided by TCP measured seconds for this window, including retransmissions. |
sparklogs.data.top_network_connections.tcp_retransmit_pct_avg | float | percent | Retransmitted payload as percent of sent payload, with the shared 256 KiB denominator floor and 100 percent cap; zero when sent bytes are zero. |
sparklogs.data.top_network_connections.tcp_timeouts | integer | count | Retransmit timeouts over accepted intervals, counted before any backoff: a stall, distinct from the fast retransmits of mild loss. Since 1.14.3 only in the intervals (about 10 s) where the connection sent at least 2 payload bytes: a connect attempt sends none (performance tcp_failed_opens counts it) and a keep-alive probe at most 1. A count: windows and rows sum; a remainder carries its scope's rest. 0 when none. |
sparklogs.data.top_network_connections.tcp_dup_ack_episodes | integer | count | Duplicate-ACK episodes this host sent over accepted intervals: each a run of duplicate acknowledgments, a segment lost or reordered on its way to this host (download loss), counted for a connection only when it received at least the pack's performance net_tcp_dup_ack_min_rx_bytes payload bytes in the window (128 KiB by default), so a heartbeat connection's keep-alive probes count none; the floor applies to each connection before rows and remainders sum. Read with tcp_data_segments_in_5m. From the receive statistics, over the intervals where they read at both ends. A count: windows and rows sum; a remainder carries its scope's rest. 0 when they read and counted none or the connections stayed below the floor; absent when they never read for this row's connections (for a remainder, for any connection it holds). |
sparklogs.data.top_network_connections.tcp_data_segments_in_5m | integer | count | Data segments (carrying payload, received again ones included) over accepted intervals, from the connections that received at least the duplicate-ACK floor in the window and whose receive statistics read, as tcp_dup_ack_episodes counts them: its denominator. A count: windows and rows sum; a remainder carries its scope's rest. 0 when its connections stayed below the floor. |
sparklogs.data.top_network_connections.timeout_connections | integer | count | On a remainder only: of the connections it holds, those with at least one retransmit timeout over accepted intervals, as tcp_timeouts counts them, so a reader can tell how many more connections stalled than the rows name. 0 when none. |
sparklogs.data.top_network_connections.rtt_ms_avg | float | milliseconds | Mean of RTT samples, weighted by sample count across contributors. Absent without a sample. |
sparklogs.data.top_network_connections.rtt_sample_count | integer | count | Round-trip samples over accepted intervals, the weight of rtt_ms_avg. A count: windows and rows sum; a remainder carries its scope's rest. 0 when none. |
sparklogs.data.top_network_connections.rtt_min_ms | integer | milliseconds | The lowest round trip any of the row's connections sampled over its measured life, the handshake included, in whole milliseconds (a LAN often reads 0); it never resets, so on a long-lived connection a lengthened route shows in rtt_ms_avg less rtt_min_ms, and a newer connection to the same peer starts over. That difference reads queueing only when the row sent at least the pack's performance net_tcp_rtt_inflation_min_bytes_per_sample per sample (tx_bytes_5m over rtt_sample_count); below it, it reads the peer's delayed-acknowledgment timer. Merged rows take the lowest. Absent without a sample, and on remainders. |
sparklogs.data.top_network_connections.destination_mode | string | Effective workspace privacy mode at window close: full, prefix, opaque or aggregate. |
This topic reports what the host looks like rather than scoring a condition on it. The values it carries are queryable on their own.
Example
Inventory (every 5 minutes)
6 TCP connection rows measured.
sparklogs.data.top_network_connections.connection: tcp:example.exe#4180->internet:443
SparkLogs: CONTEXT, Info, top_network_connections: INVENTORY: 6 TCP connection rows measured.
Inventory (every 5 minutes)
6 TCP connection rows measured.
sparklogs.data.top_network_connections.connection: tcp:192.0.2.1:40000->1.1.1.1:443
SparkLogs: CONTEXT, Info, top_network_connections: INVENTORY: 6 TCP connection rows measured.
Inventory (every 5 minutes)
6 TCP connection rows measured.
sparklogs.data.top_network_connections.connection: tcp:192.0.2.1:40000->opaque_0000000000000001:443
SparkLogs: CONTEXT, Info, top_network_connections: INVENTORY: 6 TCP connection rows measured.
Inventory (every 5 minutes)
6 TCP connection rows measured.
sparklogs.data.top_network_connections.connection: tcp:192.0.2.1:40000->1.1.1.0/24:443
SparkLogs: CONTEXT, Info, top_network_connections: INVENTORY: 6 TCP connection rows measured.