Skip to content

Traffic Discovery

Traffic Discovery lets XoT-Locks observe network connections seen on their device-side interface and report them back to the XMS, where an administrator can review what traffic is flowing on the protected side of the deployment. It is not available on XoT-Bridges.

It is intended as a visibility tool: it helps confirm that the expected devices are talking to the expected destinations, surfaces unexpected flows, and provides a record that can be exported for further analysis. It does not block or alter traffic. Access control is still handled by policies.

How It Works

When Traffic Discovery is enabled on an XoT, the XoT observes traffic on its device-side interface and periodically reports the observed connections to the XMS, which attempts to map each endpoint to a known asset.

Traffic Discovery records only the metadata of observed connections — endpoints, ports, protocol, and byte/packet counts. It does not capture payload data.

Enabling Traffic Discovery on an XoT

Traffic Discovery is configured per XoT, on the XoT's Advanced tab in the XMS.

  1. Navigate to Infrastructure → XoT-Locks or Unassigned XoTs and open the XoT you want to configure.
  2. Open the Advanced tab and locate the Traffic Discovery section.
  3. Toggle Enabled on.
  4. Optionally adjust Report period (s) — the number of seconds between traffic reports sent from the XoT to the XMS. Valid values are between 30 and 300 seconds. The default is 30.
  5. Save the XoT configuration.

The XoT will pick up the change on its next configuration sync and begin sending traffic reports at the configured interval. Disabling the setting stops new reports; data that was already collected remains in the XMS until it ages out.

Choosing a Report Period

A shorter report period gives faster feedback in the dashboard at the cost of more frequent uplink traffic from the XoT. A longer period reduces overhead but delays when newly observed flows appear in the XMS. In most deployments the default of 30 seconds is appropriate; consider increasing it on XoTs with constrained uplink capacity or when monitoring a large number of long-lived flows.

Viewing Traffic in the XMS

Navigate to Infrastructure → Traffic Discovery in the main menu. The page lists network connections observed across all XoTs that have Traffic Discovery enabled. It is only available to users with the admin or superadmin role.

The header provides three controls:

  • View toggle — switch between Flat (one row per observed flow) and By asset (rows grouped by the asset on the protected side).
  • Time range — 6H, 24H, 1W, or All. Selects the time window for which traffic is shown.
  • CSV — download the currently selected time range as a CSV file (see CSV Export below).

Flat View

In the Flat view each row represents a single observed flow within the selected time range, with the following columns:

  • Source Asset / Destination Asset — the asset matched to the source or destination of the flow, if any. Endpoints that do not correspond to a known asset show —.
  • Source MAC / Destination MAC — the layer-2 addresses observed.
  • Source IP / Destination IP — the layer-3 addresses observed.
  • Source Port / Destination Port — for TCP and UDP flows, the port numbers, annotated with a service name where one is recognized (for example 443 (https)).
  • XoT Lock — the XoT-Lock that observed the flow.
  • Protocol — the transport or network protocol (TCP, UDP, ICMP, etc.).
  • Bytes / Packets — accumulated counters for the flow.
  • First Seen / Last Seen — timestamps for when the flow first appeared and was most recently observed.

By-Asset View

In the By asset view, flows are aggregated by the asset on the protected side. Each row shows the Asset, its MAC and IP Address, the XoT Lock it sits behind, a Flows count, and TX Bytes / RX Bytes totals. Expanding a row reveals the individual remotes the asset talked to, with source/destination MAC, IP, and port, the protocol, TX and RX byte and packet counters, and first/last seen timestamps. Flows whose endpoints could not be mapped to an asset are grouped under their MAC and IP so they remain visible.

This view is useful for answering questions such as which devices on this XoT-Lock are the busiest or who is each device talking to. The Flat view is better when you need to inspect individual connections.

CSV Export

The CSV button downloads the flows for the currently selected time range as a CSV file named traffic-discovery.csv. The file includes the XoT name and ID, matched asset names, source and destination MAC/IP/port (with service annotations), protocol, byte and packet counters, and first/last seen timestamps.

Asset Matching

When a traffic report arrives, the XMS attempts to map each endpoint to a known asset:

  • For endpoints on the protected side of the XoT, IP addresses are matched against assets configured for that XoT, including DHCP-assigned and statically configured addresses.
  • For unknown endpoints (devices not yet known to the XMS, or remote destinations), the raw MAC and IP are stored and displayed.

The matched asset is stamped on each record at insert time, so renaming or reassigning an asset later will not retroactively rewrite historical rows. If asset mapping is important to you, configure the relevant assets before enabling Traffic Discovery on the XoT that observes them. The Discovered Assets workflow can help here: devices that the XoT sees by DHCP appear under Discovered and can be promoted to managed assets with one click.

Data Retention

Traffic Discovery records are retained in the XMS for 30 days by default. Older records are removed automatically.