Application Identification

Flowmon extends flow-based monitoring with application-level visibility through the application identification feature. This processing module enriches flow records with application name and cloud platform information, enabling you to analyze network traffic at the application layer without relying solely on port-based classification.

Overview

The Add application information processing module classifies network traffic and adds contextual information to flow records. This enables you to:

• Identify which applications and cloud services generate network traffic
• Analyze bandwidth consumption by application rather than just by IP address or port
• Create reports that show application usage patterns across your network
• Investigate security incidents with application context

The feature uses an application identification database that is regularly updated through the Flowmon update server. Traffic classification is performed by matching flows against known IP addresses and network subnets associated with specific applications and cloud platforms.

How Application Identification Works

When the Add application information processing module is enabled, the Flowmon Collector analyzes incoming flow records and attempts to identify the associated application or cloud platform. The classification process works as follows:

1. IP Address Matching: The source and destination IP addresses in each flow are compared against a database of known IP addresses associated with specific applications and cloud services.

2. Subnet Matching: If no direct IP address match is found, the collector checks whether the IP addresses belong to network subnets associated with specific cloud platforms or application providers.

3. Record Enrichment: When a match is found, the collector adds application and platform information to the flow record.

Supported Fields

When the application identification module processes a flow record, it adds the following fields:

Field	Description
cloud-application	The name of the identified application or service (for example, Microsoft Teams, Salesforce, AWS S3)
cloud-platform	The cloud platform associated with the traffic (for example, Microsoft Azure, Amazon Web Services, Google Cloud)

You can use these fields for filtering, grouping, and reporting in Advanced Analysis, Dashboards, and Reports. Use the filter syntax cloud-application or cloud-platform to include these fields in your analysis.

Prerequisites and Requirements

To use the application identification feature effectively, ensure that the following requirements are met:

Requirement	Details
Flowmon Collector	Application identification is performed by the Collector. Ensure that a Collector is deployed and receiving flow data.
Update Server Access	The Collector must have network access to the Flowmon update server to receive database updates.
Valid Support Contract	A valid, non-expired support contract is required for the Add application information feature to be active and for flow records to be enriched with application name and cloud platform information.

Enabling Application Identification

To enable the application identification feature:

1. Go to Configuration Center > FMC Configuration > Processing modules.
2. Enable the Add application information option.
3. Click Save & Deploy to apply the configuration.

The processing module becomes active immediately after deployment. New flow records received by the Collector will be enriched with application identification data when a match is found.

For more information about processing modules, see Flowmon Monitoring Center Configuration.

Viewing Application Information

Application and platform information appears in various parts of the Flowmon interface once the processing module is enabled.

Advanced Analysis

In Advanced Analysis, application information is obtained directly from the processed flow records. The identification reflects the state of the application database at the time the flows were received and processed. This provides the most accurate representation of application identification.

Dashboards and Reports

In Dashboards and Reports, application icons and information are resolved at the time of the widget data query, not at the time the flows were originally processed. This means:

• Application icons may differ from those shown in Advanced Analysis for the same flows
• If an application's IP address range changes between flow receipt and report generation, the displayed application may differ
• For precise application identification results, use Advanced Analysis

Troubleshooting

Applications Not Being Identified

If application identification is not working as expected:

1. Verify the module is enabled: Go to Configuration Center > FMC Configuration > Processing modules and confirm Add application information is enabled.

2. Check update server connectivity: Ensure the Collector can reach the Flowmon update server. Network restrictions or proxy configurations may block database updates.

3. Verify support contract status: Application identification database updates require a valid support contract. Contact Flowmon Support to verify your support status.

Inconsistent Application Icons

If application icons differ between Advanced Analysis and Dashboards/Reports:

• This is expected behavior due to different resolution timing.
• Use Advanced Analysis for precise, flow-time identification.
• Dashboards and Reports resolve icons at query time, which may differ from flow receipt time.

Unknown Applications

Not all network traffic can be classified:

• Traffic to IP addresses not in the application database is not enriched with application information.
• Internal applications and custom services are typically not in the database.
• Some applications use dynamic IP addresses that may not be tracked.