Network Analytics Logs
The descriptions below detail the fields available for network_analytics_logs.
AttackCampaignID
Section titled “AttackCampaignID”Type: string
Unique identifier of the attack campaign that this packet was a part of, if any.
AttackID
Section titled “AttackID”Type: string
Unique identifier of the mitigation that matched the packet, if any.
AttackVector
Section titled “AttackVector”Type: string
Descriptive name of the type of attack that this packet was a part of, if any. Only for packets matching rules contained within the Cloudflare L3/4 managed ruleset.
ColoCity
Section titled “ColoCity”Type: string
The city where the Cloudflare data center that received the packet is located.
ColoCode
Section titled “ColoCode”Type: string
The Cloudflare data center that received the packet (nearest IATA airport code).
ColoCountry
Section titled “ColoCountry”Type: string
The country where the Cloudflare data center that received the packet is located (ISO 3166-1 alpha-2).
ColoGeoHash
Section titled “ColoGeoHash”Type: string
The latitude and longitude where the Cloudflare data center that received the packet is located (Geohash encoding).
ColoName
Section titled “ColoName”Type: string
The unique site identifier of the Cloudflare data center that received the packet (for example, 'ams01', 'sjc01', 'lhr01').
Datetime
Section titled “Datetime”Type: int or string
The date and time the event occurred at the edge.
DestinationASN
Section titled “DestinationASN”Type: int
The ASN associated with the destination IP of the packet.
DestinationASNName
Section titled “DestinationASNName”Type: string
The name of the ASN associated with the destination IP of the packet.
DestinationCountry
Section titled “DestinationCountry”Type: string
The country where the destination IP of the packet is located (ISO 3166-1 alpha-2).
DestinationGeoHash
Section titled “DestinationGeoHash”Type: string
The latitude and longitude where the destination IP of the packet is located (Geohash encoding).
DestinationPort
Section titled “DestinationPort”Type: int
Value of the Destination Port header field in the TCP or UDP packet.
Direction
Section titled “Direction”Type: string
The direction in relation to customer network.
Possible values are ingress | egress.
GREChecksum
Section titled “GREChecksum”Type: int
Value of the Checksum header field in the GRE packet.
GREEtherType
Section titled “GREEtherType”Type: int
Value of the EtherType header field in the GRE packet.
GREHeaderLength
Section titled “GREHeaderLength”Type: int
Length of the GRE packet header, in bytes.
GREKey
Section titled “GREKey”Type: int
Value of the Key header field in the GRE packet.
GRESequenceNumber
Section titled “GRESequenceNumber”Type: int
Value of the Sequence Number header field in the GRE packet.
GREVersion
Section titled “GREVersion”Type: int
Value of the Version header field in the GRE packet.
ICMPChecksum
Section titled “ICMPChecksum”Type: int
Value of the Checksum header field in the ICMP packet.
ICMPCode
Section titled “ICMPCode”Type: int
Value of the Code header field in the ICMP packet.
ICMPType
Section titled “ICMPType”Type: int
Value of the Type header field in the ICMP packet.
IPDestinationAddress
Section titled “IPDestinationAddress”Type: string
Value of the Destination Address header field in the IPv4 or IPv6 packet.
IPDestinationSubnet
Section titled “IPDestinationSubnet”Type: string
Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6).
IPFragmentOffset
Section titled “IPFragmentOffset”Type: int
Value of the Fragment Offset header field in the IPv4 or IPv6 packet.
IPHeaderLength
Section titled “IPHeaderLength”Type: int
Length of the IPv4 or IPv6 packet header, in bytes.
IPMoreFragments
Section titled “IPMoreFragments”Type: int
Value of the More Fragments header field in the IPv4 or IPv6 packet.
IPProtocol
Section titled “IPProtocol”Type: int
Value of the Protocol header field in the IPv4 or IPv6 packet.
IPProtocolName
Section titled “IPProtocolName”Type: string
Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet.
IPSourceAddress
Section titled “IPSourceAddress”Type: string
Value of the Source Address header field in the IPv4 or IPv6 packet.
IPSourceSubnet
Section titled “IPSourceSubnet”Type: string
Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6).
Type: int
Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet.
IPTTLBuckets
Section titled “IPTTLBuckets”Type: int
Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated.
IPTotalLength
Section titled “IPTotalLength”Type: int
Total length of the IPv4 or IPv6 packet, in bytes.
IPTotalLengthBuckets
Section titled “IPTotalLengthBuckets”Type: int
Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated.
IPv4Checksum
Section titled “IPv4Checksum”Type: int
Value of the Checksum header field in the IPv4 packet.
IPv4DSCP
Section titled “IPv4DSCP”Type: int
Value of the Differentiated Services Code Point header field in the IPv4 packet.
IPv4DontFragment
Section titled “IPv4DontFragment”Type: int
Value of the Don't Fragment header field in the IPv4 packet.
IPv4ECN
Section titled “IPv4ECN”Type: int
Value of the Explicit Congestion Notification header field in the IPv4 packet.
IPv4Identification
Section titled “IPv4Identification”Type: int
Value of the Identification header field in the IPv4 packet.
IPv4Options
Section titled “IPv4Options”Type: string
List of Options numbers included in the IPv4 packet header.
IPv6DSCP
Section titled “IPv6DSCP”Type: int
Value of the Differentiated Services Code Point header field in the IPv6 packet.
IPv6ECN
Section titled “IPv6ECN”Type: int
Value of the Explicit Congestion Notification header field in the IPv6 packet.
IPv6ExtensionHeaders
Section titled “IPv6ExtensionHeaders”Type: string
List of Extension Header numbers included in the IPv6 packet header.
IPv6FlowLabel
Section titled “IPv6FlowLabel”Type: int
Value of the Flow Label header field in the IPv6 packet.
IPv6Identification
Section titled “IPv6Identification”Type: int
Value of the Identification extension header field in the IPv6 packet.
MitigationReason
Section titled “MitigationReason”Type: string
Reason for applying a mitigation to the packet, if any.
Possible values are BLOCKED | RATE_LIMITED |UNEXPECTED | CHALLENGE_NEEDED | CHALLENGE_PASSED | NOT_FOUND | OUT_OF_SEQUENCE | ALREADY_CLOSED.
MitigationScope
Section titled “MitigationScope”Type: string
Whether the packet matched a local or global mitigation, if any.
Possible values are local | global.
MitigationSystem
Section titled “MitigationSystem”Type: string
Which Cloudflare system sampled the packet.
Possible values are dosd | flowtrackd | magic-firewall.
Outcome
Section titled “Outcome”Type: string
The action that Cloudflare systems took on the packet.
Possible values are pass | drop.
ProtocolState
Section titled “ProtocolState”Type: string
State of the packet in the context of the protocol, if any.
Possible values are OPEN | NEW | CLOSING | CLOSED.
RuleID
Section titled “RuleID”Type: string
Unique identifier of the rule contained within the Cloudflare L3/4 managed ruleset that this packet matched, if any.
RuleName
Section titled “RuleName”Type: string
Human-readable name of the rule contained within the Cloudflare L3/4 managed ruleset that this packet matched, if any.
RulesetID
Section titled “RulesetID”Type: string
Unique identifier of the Cloudflare L3/4 managed ruleset containing the rule that this packet matched, if any.
Possible values are 3b64149bfa6e4220bbbc2bd6db589552.
RulesetOverrideID
Section titled “RulesetOverrideID”Type: string
Unique identifier of the rule within the accounts root ddos_l4 phase ruleset which resulted in an override of the default sensitivity or action being applied/evaluated, if any.
SampleInterval
Section titled “SampleInterval”Type: int
The sample interval is the inverse of the sample rate. For example, a sample interval of 1000 means that this packet was randomly sampled from 1 in 1000 packets. Sample rates are dynamic and based on the volume of traffic.
SourceASN
Section titled “SourceASN”Type: int
The ASN associated with the source IP of the packet.
SourceASNName
Section titled “SourceASNName”Type: string
The name of the ASN associated with the source IP of the packet.
SourceCountry
Section titled “SourceCountry”Type: string
The country where the source IP of the packet is located (ISO 3166-1 alpha-2).
SourceGeoHash
Section titled “SourceGeoHash”Type: string
The latitude and longitude where the source IP of the packet is located (Geohash encoding).
SourcePort
Section titled “SourcePort”Type: int
Value of the Source Port header field in the TCP or UDP packet.
TCPAcknowledgementNumber
Section titled “TCPAcknowledgementNumber”Type: int
Value of the Acknowledgement Number header field in the TCP packet.
TCPChecksum
Section titled “TCPChecksum”Type: int
Value of the Checksum header field in the TCP packet.
TCPDataOffset
Section titled “TCPDataOffset”Type: int
Value of the Data Offset header field in the TCP packet.
TCPFlags
Section titled “TCPFlags”Type: int
Value of the Flags header field in the TCP packet.
TCPFlagsString
Section titled “TCPFlagsString”Type: string
Human-readable string representation of the Flags header field in the TCP packet.
TCPMSS
Section titled “TCPMSS”Type: int
Value of the MSS option header field in the TCP packet.
TCPOptions
Section titled “TCPOptions”Type: string
List of Options numbers included in the TCP packet header.
TCPSACKBlocks
Section titled “TCPSACKBlocks”Type: string
List of the SACK Blocks option header in the TCP packet.
TCPSACKPermitted
Section titled “TCPSACKPermitted”Type: int
Value of the SACK Permitted option header in the TCP packet.
TCPSequenceNumber
Section titled “TCPSequenceNumber”Type: int
Value of the Sequence Number header field in the TCP packet.
TCPTimestampECR
Section titled “TCPTimestampECR”Type: int
Value of the Timestamp Echo Reply option header in the TCP packet.
TCPTimestampValue
Section titled “TCPTimestampValue”Type: int
Value of the Timestamp option header in the TCP packet.
TCPUrgentPointer
Section titled “TCPUrgentPointer”Type: int
Value of the Urgent Pointer header field in the TCP packet.
TCPWindowScale
Section titled “TCPWindowScale”Type: int
Value of the Window Scale option header in the TCP packet.
TCPWindowSize
Section titled “TCPWindowSize”Type: int
Value of the Window Size header field in the TCP packet.
UDPChecksum
Section titled “UDPChecksum”Type: int
Value of the Checksum header field in the UDP packet.
UDPPayloadLength
Section titled “UDPPayloadLength”Type: int
Value of the Payload Length header field in the UDP packet.
Verdict
Section titled “Verdict”Type: string
The action that Cloudflare systems think should be taken on the packet.
Possible values are pass | drop.
Was this helpful?
- Resources
- API
- New to Cloudflare?
- Products
- Sponsorships
- Open Source
- Support
- Help Center
- System Status
- Compliance
- GDPR
- Company
- cloudflare.com
- Our team
- Careers
- 2025 Cloudflare, Inc.
- Privacy Policy
- Terms of Use
- Report Security Issues
- Trademark