Network Monitoring

Overview

The Monitoring Network Traffic Monitoring module provides deep visibility into traffic flows, bandwidth consumption, and protocol distribution across your virtual and physical networks. Operations teams use it to identify top bandwidth consumers, investigate anomalous patterns, and baseline normal network behavior.

Prerequisites

An active Polystack account with project access
Network flow collection configured by your administrator (see Monitoring Admin — Agent Configuration)

Network Traffic Views

Dashboard
CLI

Navigate to Monitor Center > Monitoring (Network section, admin view) to access network monitoring views.

View	Shows
Traffic Overview	Total inbound/outbound traffic per interface over time
Top Talkers	Highest-bandwidth source/destination pairs
Protocol Analysis	Traffic breakdown by protocol (TCP, UDP, ICMP, application layer)
Flow Table	Individual network flows with source, destination, port, and bytes
Anomaly Detection	Unusual traffic patterns flagged by behavioral analysis

Set the Scope filter to a specific project, network, or subnet to isolate traffic for a particular project or application tier.

Get top bandwidth consumers (last 1h)

monitoring network top-talkers --period 1h --limit 10

Show traffic for a specific host

monitoring network flows --host 10.0.1.50 --from now-24h

Export flow data

monitoring network export \
  --network prod-tenant-net \
  --from 2026-03-17T00:00 \
  --to 2026-03-17T23:59 \
  --output flows-2026-03-17.csv

Analyzing Traffic Anomalies

Review the Anomaly Detection panel

Navigate to Monitor Center > Monitoring (Network Anomaly, admin view). Monitoring uses behavioral baselines to flag traffic patterns that deviate significantly from historical norms.Each anomaly entry shows:

Detection time and duration
Affected host or network segment
Anomaly type (volumetric, port scan, protocol violation, etc.)
Confidence score

Drill into suspicious flows

Click on an anomaly event to view the associated flow records. Use the Flow Table to examine individual connections:

Column	Description
Source IP	Originating IP address
Destination IP	Target IP address
Port	Destination port
Protocol	TCP, UDP, ICMP
Bytes	Total data transferred in this flow
Duration	Flow lifetime in seconds

Correlate with logs

Cross-reference suspicious traffic with log events in the Log Explorer:

host:<SUSPICIOUS_IP> level:ERROR

Combined network flow data and log events often confirm whether an anomaly is malicious or benign (e.g., a legitimate backup job generating unusual burst traffic).

Use Monitoring’s Linked Panels feature to open the Log Explorer pre-filtered to the host and time range of a network anomaly with a single click.

Setting Network Traffic Alerts

Alert on network conditions that indicate problems or security events:

Bandwidth Threshold Alert
Packet Loss Alert

Navigate to Monitor Center > Monitoring (Create Alert Rule, admin view):

Field	Value
Metric	`polystack_network_interface_rx_bytes`
Condition	`>`
Threshold	900000000 (900 MB/s — 90% of 1 GbE)
Evaluation Period	5 minutes
Severity	Warning

alert-packet-loss.yaml

name: high-packet-loss
metric: polystack_network_packet_loss_pct
condition: ">"
threshold: 1
evaluation_period: 5m
severity: critical
notification_channels:
  - ops-email

Create alert

monitoring alert rule create --file alert-packet-loss.yaml

Next Steps

Metrics & Alerts

Create bandwidth and packet loss alert rules

Log Analytics

Correlate network anomalies with log events from the same time window

Alert Rules (Advanced)

Configure compound alert conditions and escalation for network events

Monitoring Admin — DDoS Protection

Configure automatic DDoS mitigation policies (administrator)

Core Services

Other Services

Overview

Network Traffic Views

Analyzing Traffic Anomalies

Review the Anomaly Detection panel

Drill into suspicious flows

Correlate with logs

Setting Network Traffic Alerts

Next Steps

Metrics & Alerts

Log Analytics

Alert Rules (Advanced)

Monitoring Admin — DDoS Protection

​Overview

​Network Traffic Views

​Analyzing Traffic Anomalies

Review the Anomaly Detection panel

Drill into suspicious flows

Correlate with logs

​Setting Network Traffic Alerts

​Next Steps

Metrics & Alerts

Log Analytics

Alert Rules (Advanced)

Monitoring Admin — DDoS Protection

Overview

Network Traffic Views

Analyzing Traffic Anomalies

Setting Network Traffic Alerts

Next Steps