Telecommunications
19 columns
1,002 rows
8 formats

Network Traffic Analytics and Flow Data (NetFlow/IPFIX)

This dataset provides comprehensive network flow analytics, capturing source and destination details, protocols, traffic volumes, flow durations, and autonomous system numbers. It includes traffic classification and anomaly detection flags, making it ideal for network monitoring, security analysis, and performance optimization across enterprise and service provider environments.

last updated 1 Nov 2025
by GoMask

The brief that made it

Real-time network traffic monitoring and visualization

Sample rows

preview · 8 of 1,002 rows · all 19 columns

flow_idstring	traffic_classificationstring	dst_portinteger	anomaly_flagboolean	protocolstring	timestamp_startdatetime	timestamp_enddatetime	duration_secondsfloat	src_ipstring	src_portinteger	dst_ipstring	byte_countinteger	packet_countinteger	src_asninteger	dst_asninteger	anomaly_typestring	flow_directionstring	device_idstring	export_protocolstring
FLO-000001	web	50821	false	TCP	2024-06-04T09:15:23Z	2024-06-04T09:16:10Z	47	192.168.13.42	443	2607:f8b0:4005:805::200e	12985	22	15169	8075	none	outbound	dev-west-001	NetFlow
FLO-000002	web	53	false	UDP	2024-06-04T10:02:44Z	2024-06-04T10:02:44Z	0	10.1.48.4	33445	198.51.100.19	65	1	20473	13335	none	outbound	dev-west-002	IPFIX
FLO-000003	file-transfer	3389	false	TCP	2024-06-04T11:30:18Z	2024-06-04T11:30:55Z	37	172.16.0.11	5201	203.0.113.66	3406	14	137409	64500	none	inbound	dev-north-001	NetFlow
FLO-000004	web	443	false	TCP	2024-06-04T12:08:32Z	2024-06-04T12:08:37Z	5	2001:db8:85a3::8a2e:370:7334	8080	192.0.2.50	440	8	23456	15169	none	inbound	dev-east-001	sFlow
FLO-000005	streaming	1935	false	UDP	2024-06-04T12:24:03Z	2024-06-04T12:35:18Z	675	203.0.113.87	49500	192.168.1.100	874220	1480	64512	23456	none	inbound	dev-north-002	NetFlow
FLO-000006	gaming	27015	false	UDP	2024-06-04T13:11:03Z	2024-06-04T13:12:09Z	66	10.0.0.32	27015	192.168.0.45	120341	205	13335	13335	none	internal	dev-west-003	NetFlow
FLO-000007	voip	5060	false	UDP	2024-06-04T13:26:41Z	2024-06-04T13:27:41Z	60	192.168.10.10	5060	203.0.113.100	2051	26	8075	64512	none	outbound	dev-south-001	NetFlow
FLO-000008	web	443	false	TCP	2024-06-04T14:00:00Z	2024-06-04T14:05:10Z	310	2001:db8:abcd:0012::1	80	198.51.100.23	93012	110	20473	15169	none	outbound	dev-east-002	sFlow
FLO-000009	other	123	false	UDP	2024-06-04T14:19:41Z	2024-06-04T14:20:59Z	78	172.16.1.1	123	192.168.1.1	452	5	23456	0	none	internal	dev-central-001	IPFIX
FLO-000010	file-transfer	22	false	TCP	2024-06-04T14:36:30Z	2024-06-04T14:36:41Z	11	192.168.5.99	22	203.0.113.55	1600	16	64500	8075	none	outbound	dev-west-004	NetFlow
FLO-000011	file-transfer	3389	false	TCP	2024-06-04T15:02:05Z	2024-06-04T15:03:15Z	70	198.51.100.200	445	192.168.100.101	22010	28	13335	23456	none	inbound	dev-east-003	IPFIX
FLO-000012	p2p	6881	false	TCP	2024-06-04T15:22:33Z	2024-06-04T15:27:19Z	286	2001:db8:85a3::8a2e:370:7335	6881	203.0.113.99	63023	67	137409	20473	none	outbound	dev-north-003	NetFlow
FLO-000013	web	80	false	TCP	2024-06-04T15:41:01Z	2024-06-04T15:41:02Z	1	192.168.1.9	80	198.51.100.11	323	4	20473	8075	none	internal	dev-central-002	IPFIX
FLO-000014	file-transfer	21	false	TCP	2024-06-04T15:57:51Z	2024-06-04T15:58:03Z	12	203.0.113.1	21	10.0.0.10	3306	16	64512	15169	none	inbound	dev-west-005	sFlow
FLO-000015	voip	5060	false	UDP	2024-06-04T16:13:22Z	2024-06-04T16:14:23Z	61	192.168.101.25	5060	198.51.100.75	1650	20	8075	13335	none	inbound	dev-east-004	NetFlow
FLO-000016	other	5000	false	UDP	2024-06-04T16:29:03Z	2024-06-04T16:29:17Z	14	10.0.1.23	5000	172.16.10.20	379	6	15169	20473	none	internal	dev-central-003	IPFIX
FLO-000017	web	443	false	TCP	2024-06-04T16:47:44Z	2024-06-04T16:48:13Z	29	192.168.0.201	443	198.51.100.111	6720	10	8075	15169	none	outbound	dev-west-006	NetFlow
FLO-000018	streaming	1935	false	UDP	2024-06-04T17:09:11Z	2024-06-04T17:13:23Z	252	203.0.113.21	1935	192.168.1.102	1184691	2050	64512	23456	none	inbound	dev-north-004	NetFlow
FLO-000019	p2p	6881	false	TCP	2024-06-04T17:25:32Z	2024-06-04T17:26:42Z	70	2001:db8:abcd:0012::55	6881	203.0.113.120	30322	29	64500	20473	none	outbound	dev-west-007	sFlow
FLO-000020	web	80	false	TCP	2024-06-04T17:41:13Z	2024-06-04T17:41:28Z	15	192.168.22.33	80	198.51.100.88	1200	12	8075	13335	none	internal	dev-central-004	IPFIX

What the 1,002 rows show

from the 1,002-row sample

P2p (traffic classification) stands out: mean dst_port is 33,007, against 7,000 for the rest.

13%anomaly_flag = true
1,935median dst_port
3flow directions
3export protocols
6anomaly types
79.0median duration_seconds

Mean dst_port by traffic_classification1,002 rows

dst_port1,002 rows, in bands of 10k

Median 1,935, from 20 to 65,535.

protocol1,002 rows · 6 values

TCP671
UDP322
ICMP6
ESP1
AH1
GRE1

19 columns by typefrom the column list below

string 9
integer 6
float 1
datetime 2
boolean 1

Columns

19 columns in four groups

blueprint · 19 columns
column	type	description	example
Text 9 columns
`flow_id`	string	Unique identifier for the network flow recordunique	FLO-000001
`src_ip`	string	Source IPv4 or IPv6 address	192.168.13.42
`dst_ip`	string	Destination IPv4 or IPv6 address	2607:f8b0:4005:805::200e
`protocol`	string	Network protocol used (e.g., TCP, UDP, ICMP)7 values	TCP
`traffic_classification`	string	Classification of traffic type (e.g., web, streaming, P2P, VoIP)7 values · optional	web
`anomaly_type`	string	Type of anomaly detected (e.g., DDoS, port scan, data exfiltration)6 values · optional	none
`flow_direction`	string	Direction of the flow relative to the monitored network (inbound, outbound, internal)inbound · outbound · internal · optional	outbound
`device_id`	string	Identifier for the network device that exported this flow recordoptional	dev-west-001
`export_protocol`	string	Protocol used to export the flow record (NetFlow, sFlow, IPFIX)NetFlow · sFlow · IPFIX	NetFlow
Numbers 7 columns
`duration_seconds`	float	Duration of the flow in seconds0 or more	47
`src_port`	integer	Source port number0 to 65.5k	443
`dst_port`	integer	Destination port number0 to 65.5k	50821
`byte_count`	integer	Total number of bytes transferred in the flow0 or more	12985
`packet_count`	integer	Total number of packets transferred in the flow0 or more	22
`src_asn`	integer	Autonomous System Number (ASN) of the source IP0 or more · optional	15169
`dst_asn`	integer	Autonomous System Number (ASN) of the destination IP0 or more · optional	8075
Dates and times 2 columns
`timestamp_start`	datetime	Date and time when the flow started	2024-06-04T09:15:23Z
`timestamp_end`	datetime	Date and time when the flow ended	2024-06-04T09:16:10Z
True or false 1 column
`anomaly_flag`	boolean	Indicates if the flow was flagged as anomalous	false

Use it for

A telecommunications dashboard
The anomaly_flag rate, dst_port by traffic_classification and a breakdown of protocol. Excel, Power BI or Tableau.
Why do the 109 p2p rows have a mean dst_port of 33,007?
A root-cause class exercise
Hand out the rows and one question. The answer is in the data, not in the brief.
Flows1,002
FLO-00000150821web
f2-5m3n7qa6881p2p
f2-8p0c9hr443streaming
A software demo
Believable flows with timestamp_start, timestamp_end and duration_seconds to fill a screen in front of a buyer.

This dataset1,002 rows19 columns

Yours1,000 rows19 columns

blueprint · network-traffic-analytics-and-flow-data-netflowipfix

Behind this dataset

Same schema. As many rows as you need.

These 1,002 rows came out of a blueprint — 19 columns with generation rules behind each one. Open it in Data Factory to retune a column, add your own, wire in foreign keys, and run it at the size you actually need.

Rules it was built with

Flow record ID and export timestamp from router/switch
5-tuple: source IP, destination IP, source port, dest port, protocol (TCP/UDP/ICMP)
Byte and packet counts for flow volume
Flow start time and flow duration (seconds)
Input/output interface on network device
AS numbers for source and destination (BGP context)
Traffic classification: P2P (BitTorrent), video streaming, web, gaming, VoIP
Anomaly detection: traffic spikes, unusual port usage, suspicious patterns

Rows1,000 rows10,000 rows100,000 rows1,000,000 rows

Open the blueprint in Data Factory

1 credit per row. Preview 20 rows free. Buy rows for the full run.

Exports: CSV, JSON, JSONL, Parquet, SQL, Excel, TSV, XML
Licence: yours to use, including commercially
API slug: network-traffic-analytics-and-flow-data-netflowipfix

What should your data show?

No signup. No card.

Sample rows

What the 1,002 rows show

Columns

Use it for

A telecommunications dashboard

A root-cause class exercise

A software demo

Make it yours.

Same schema. As many rows as you need.

More in Telecommunications

What should your data show?