{{ summaryTitle }} {{ summaryValue }} {{ summaryLine }} {{ badge.label }} {{ badge.value }}
Paste one bounded collector export or load one local CSV, TSV, TXT, or LOG file. Processing stays in this browser tab.
{{ sourceStatus }}
Auto reports the resolved format in the summary and Traffic snapshot.
rows
Zero keeps every valid row regardless of byte count.
bytes
Zero keeps every valid row regardless of packet count.
packets
All protocols is neutral; a pinned family changes the active denominator.
All destinations is neutral; hostnames and reserved text remain only in that view.
This display/export limit does not change the grouped totals or findings.
rows
MetricValueOperator readCopy
{{ row.metric }}{{ row.value }}{{ row.note }}
RankTalkerBytesPacketsFlowsByte shareAvg B/pktTop peerDominant serviceCopy
{{ row.rank }}{{ row.label }}{{ formatBytes(row.bytes) }}{{ formatInteger(row.packets) }}{{ formatInteger(row.flows) }}{{ formatPercent(row.traffic_share) }}{{ row.avg_packet_bytes ? formatBytes(row.avg_packet_bytes) : 'n/a' }}{{ row.top_peer }} · {{ formatBytes(row.top_peer_bytes) }}{{ row.dominant_service }} · {{ formatBytes(row.dominant_service_bytes) }}
SignalStateEvidenceOperator actionCopy
{{ row.signal }}{{ row.state }}{{ row.evidence }}{{ row.action }}
#SourceDestinationProtocolSrc portDst portBytesPacketsFlowsDurationCopy
{{ row.index }}{{ row.source }}{{ row.destination }}{{ row.protocol }}{{ row.source_port }}{{ row.destination_port }}{{ formatBytes(row.bytes) }}{{ formatInteger(row.packets) }}{{ formatInteger(row.flows) }}{{ formatDuration(row.duration_seconds) }}
The chart could not load. Check your connection and retry.

Correct the current input to plot traffic.

The chart could not load. Check your connection and retry.

Correct the current input to plot traffic.

Port List Checker Normalize mixed TCP and UDP port lists into compact ranges and target strings with IANA bands, duplicate checks and service exposure cues.
Ephemeral Port Exhaustion Calculator Estimate ephemeral port pressure for a hot destination from connection churn, held time and source inventory with reserve and capacity thresholds.
Firewall Deny Log Analyzer Analyze firewall deny logs into ranked traffic paths using format-aware parsing, CIDR direction checks and transparent priority scores.
Route Table Longest Match Checker Find the IPv4 or IPv6 route that wins for a destination using longest-prefix lookup, selectable tie-break rules, and CIDR cleanup warnings.

A saturated link does not reveal what is causing the load. One endpoint may be transferring a backup, a service may be receiving thousands of small requests, or many short connections may be consuming more packet-processing time than bandwidth. Flow records make those patterns comparable without capturing application payloads.

NetFlow and IP Flow Information Export (IPFIX) summarize traffic observed by a router, switch, firewall, or collector. A row usually identifies two endpoints and may include protocol, ports, byte and packet counters, timing, and a count of aggregated flows. The observation point and export policy determine what the row means. Direction can reverse across interfaces, network address translation can replace the original address, and sampling can make one collector's totals unsuitable for direct comparison with another.

A top talker is simply the leading group under a chosen measure. The group may be a source, destination, conversation, service, protocol, or destination port. The measure changes the question:

Bytes
Finds traffic volume such as replication, backups, downloads, and bulk transfers.
Packets
Highlights packet load from retries, scans, keepalives, or control traffic.
Flow count
Surfaces connection churn, broad fan-out, and repeated short sessions.

Ranks and concentration percentages help narrow an incident or capacity question, but they do not identify intent. A dominant host may be expected during a maintenance window, and a distributed scan may never become the largest byte sender. Port numbers suggest services but do not prove which application produced the traffic.

Useful comparisons keep the time window, exporter, direction, sampling rate, and counter definitions fixed. Missing or rejected rows also matter because every total and percentage depends on which records entered the analysis.

How to Use This Tool:

Use one bounded export from a known observation window, then match the grouping and ranking measure to the question you need to answer.

  1. Paste or load the flow rows. Auto detect distinguishes comma-, tab-, and whitespace-separated text from the first useful row. Pin Source format when that guess is wrong.
  2. Choose Group flows by. Select an endpoint for ownership, a conversation for a directional peer pair, or service, protocol, or destination port for workload patterns.
  3. Select Rank by. Use bytes for volume, packets for processing load, or flow count for connection churn. Top talkers accepts 3 to 25 groups.
  4. Apply only relevant filters. Minimum bytes and packets remove rows below their inclusive floors. Protocol and destination scope are also applied before totals, shares, and rankings are calculated.
    If all valid rows disappear, lower the minimums or restore All protocols and All destinations. An empty filtered result does not mean the original export contained no traffic.
  5. Review parser coverage. Resolve skipped rows or document the missing evidence before using the leading group, concentration signal, or service mix in an incident conclusion.

Interpreting Results:

Read the selected rank beside byte share. A source can lead by flow count while carrying little volume, and the byte leader may not create the most packets. The top-three byte share describes concentration among the first three displayed groups even when another measure controls their order.

  • Focused means the leading group carries at least 60% of active bytes.
  • Service-heavy means the leading protocol and destination-port pair carries at least 50% of active bytes.
  • Internet-heavy means at least 40% of active bytes target addresses classified as external.
  • Packet-heavy means the average is above 0 B and below 160 B per packet.

Each label is a review cue. Confirm ownership, expected transfers, address translation, and the collection window before treating it as abnormal traffic.

Technical Details:

Top-talker analysis depends first on parsing and then on aggregation. A row that is rejected or assigned to the wrong column never reaches the selected totals, so the parse result is part of the analysis rather than a separate formatting concern.

Transformation Core:

Stage Rule Boundary
Separate rows Auto detection chooses tab, comma, or whitespace separation from the first non-comment row unless the format is pinned. Input is limited to 1 MiB.
Map fields Common header aliases map endpoints, protocol, ports, counters, and timing. Otherwise one of three positional layouts is used. A header needs at least two known fields and a bytes, packets, or flows field.
Accept evidence At least one endpoint and one finite, non-negative counter must be present. Missing bytes or packets become 0; a missing flow count becomes 1.
Filter and group Numeric floors, protocol, and destination scope are applied before rows are summed under the selected key. A row remains when bytes and packets are both greater than or equal to their floors.
Rank Groups sort by the selected measure, then by bytes, then alphabetically by label. The displayed list contains 3 to 25 groups.

Destination scope is a local address classification, not an ownership lookup. Private includes IPv4 private, loopback, link-local, and shared carrier-grade NAT ranges plus IPv6 loopback, unique-local, and link-local forms. Other ordinary IPv4 and globally shaped IPv6 addresses are treated as external, while reserved or unrecognized text remains separate.

Formula Core:

Shares use only active rows. The ranking denominator follows the selected measure, while traffic concentration always uses bytes.

Srank= MgroupMactive ×100
Sbytes= BgroupBactive×100 , Apacket= BactivePactive

A zero denominator returns 0. Ranking uses full precision; percentages and average packet size are displayed to one decimal place.

Rule Core:

Signal Flagged rule Other result
Talker concentration Leading byte share >= 60% Distributed
Service mix Leading service byte share >= 50% Mixed
External destination share External byte share >= 40% Mostly internal
Packet-size clue 0 B < average < 160 B Payload-weighted
Parser coverage At least one row is rejected Clean parse

Privacy and Accuracy Notes:

Flow text and loaded files stay in the browser during analysis. The data can still expose internal addresses, peer relationships, service names, and traffic volumes, so remove sensitive rows before copying or sharing a result.

  • The accepted input is collector-style text, not raw binary NetFlow or IPFIX messages and not every vendor-specific export.
  • Sampling, missing exports, duplicate rows, counter direction, and unequal windows can change totals and rankings.
  • Protocol, port, and address classes are clues. They do not verify the application, owner, authorization, or intent.

References: