# What is Network Traffic?

> Network traffic is the collection or stream of frames, packets, and higher-layer messages carried across network links and devices.

- Canonical URL: https://yellowcube.eu/glossary/network-traffic/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It includes payload and protocol data, plus observable endpoints, ports, timing, size, direction, and treatment. Its exact meaning depends on the layer and observation point being discussed.

Traffic may be observed through packet capture, flow records, interface counters, protocol logs, or purpose-built sensors. Packets preserve more detail; flows summarize packets sharing defined properties; counters aggregate still further. These observations can become security telemetry when they are collected and used as evidence for detection, investigation, assurance, or response; retention and enrichment depend on the use case.

### Key points

- **Operational use:** Traffic observations support capacity planning, troubleshooting, policy verification, incident investigation, and detection of behavior that differs from a baseline.
- **Collection design:** Place observation points according to the question being answered, synchronize time, document filtering and sampling, protect collectors, and validate that expected traffic can reach them.
- **Privacy and governance:** Network content and metadata can reveal communications, relationships, locations, and user behavior. Establish authority, purpose, notice where applicable, access controls, minimization, retention, and secure disposal before monitoring.
- **Important limitation:** No observation point provides complete truth. Encryption limits content visibility; tunneling, asymmetric routing, segmentation, sampling, sensor overload, and packet loss create gaps. Unusual traffic is a lead for analysis, not proof of malicious activity.

### Related terms

[Security telemetry](<https://yellowcube.eu/glossary/security-telemetry/>) · [Network detection and response (NDR)](<https://yellowcube.eu/glossary/network-detection-and-response/>) · [Network monitoring](<https://yellowcube.eu/glossary/network-monitoring/>) · [Network segmentation](<https://yellowcube.eu/glossary/network-segmentation/>) · [Packet loss](<https://yellowcube.eu/glossary/packet-loss/>)

### Sources

[RFC 7011: IP Flow Information Export (IPFIX)](https://www.rfc-editor.org/rfc/rfc7011) · [NIST SP 800-137: Information Security Continuous Monitoring](https://csrc.nist.gov/pubs/sp/800/137/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.