netflow_search
Search the FULL NetFlow history: the raw flow table (the last ~15 minutes) unioned with the aggregated rollup (4 weeks of history), windowed and pro-rated server-side. Wraps GET /api/aggnetflow/list (permission: vne). For per-flow packet counts and exact timing, use netflow_raw_search instead — that's the right drill-down once this tool surfaces an interesting src/dst pair, but it only reaches back about 15 minutes.
IP filters: src_ip and dst_ip are STRICT equality on that one column and NEVER match the opposite side. When you don't already know which side of the conversation the host sat on, use the compound ip filter (src_ip OR dst_ip) — reaching for src_ip instead silently drops every conversation where the host was the destination. Passing both src_ip and dst_ip ANDs them into a single direction.
Port filters: dst_port is strict equality; src_port is matched with ANY against the aggregated src_ports[] array, because this table has no scalar src_port column. The compound port matches dst_port OR src_ports[] ANY.
Window semantics: the predicate is OVERLAP — any flow ACTIVE during the window matches, including one straddling either edge — and every row carries TWO byte figures: window_bytes (the row's bytes pro-rated to the query window, assuming a uniform rate) and bytes (the row's own full count: for an aggregated row a SUM, with start_time a MIN and end_time a MAX over every flow folded in). Sum window_bytes for in-window bandwidth — quoting bytes for that over-reports edge-straddling conversations. is_raw marks which arm of the union produced a row. There is no packets column here. Direction is normalized on BOTH arms: the lower-numbered port of each conversation becomes dst_port (raw rows are re-oriented the same way on read), so dst_ip is the service side and src_ip the client side regardless of who sent the first packet.
Window: hours (default 24) OR start_time+end_time; this tool always sends an explicit window, so the controller's no-window fallback (conversations still open right now) never applies. limit defaults to 50; total is the full match count. Narrow via IP/port/protocol when truncated.
Tag-scoped server-side on the conversation ENDPOINTS — src_ip / dst_ip against the caller's in-tag device IPs, not flow_src.
Example: netflow_search({ip: '10.0.0.5', dst_port: 443, hours: 1})
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ip | No | Compound: matches src_ip OR dst_ip. Prefer this over src_ip/dst_ip whenever the host's side is unknown. | |
| port | No | Compound: matches dst_port OR src_port (via src_ports[] ANY). | |
| vlan | No | VLAN id. | |
| hours | No | Lookback hours (1-168). Default 24. | |
| limit | No | Max rows (1-500). Default 50. | |
| dst_ip | No | Strict equality on dst_ip alone — never matches a host sitting on the src side. Use `ip` unless you know the direction. | |
| src_ip | No | Strict equality on src_ip alone — never matches a host sitting on the dst side. Use `ip` unless you know the direction. | |
| dst_port | No | Destination port (strict equality). After rollup this is the LOWER port of the conversation, i.e. the service port. | |
| end_time | No | ISO-8601 UTC; pairs with start_time. | |
| flow_src | No | IP of the device that exported the flow. | |
| in_iface | No | Ingress SNMP ifIndex on the exporting device, e.g. "5". A number, not an interface name and not an interfaces.id. | |
| protocol | No | IP protocol NUMBER, e.g. "6" (TCP), "17" (UDP), "1" (ICMP). The column is an integer — protocol names are rejected by the database. | |
| src_port | No | Source port (matched via ANY against the aggregated src_ports[] array). | |
| out_iface | No | Egress SNMP ifIndex, e.g. "7". A number, not an interface name. | |
| start_time | No | ISO-8601 UTC; pairs with end_time. |