Cisco Stealthwatch identification of traffic direction

[NetworkingGeek1]

Hello community,

I have a question how to identify traffic direction in Cisco Stealthwatch web interface. If open "Analyze" -> "Flow search" -> "Flow" there are: "Subject Bytes", "Total Bytes" & "Peer Bytes". So, total bytes is pretty straightforward, it's for both inbound and outbound traffic direction. But what about "Subject Bytes" for example? Does it mean how much traffic was sent by this particular host (subject) or how much traffic was received? The same question for "Peer Bytes". I didn't find clear information in Cisco documentation about it.

Thank you in advance.

[marce1000 · Accepted solution]

 - In the Cisco Stealthwatch web interface, the "Subject Bytes" column represents the number of bytes sent by the host specified as the "subject" in the flow search. The "Peer Bytes" column represents the number of bytes sent by the host specified as the "peer" in the flow search. So Subject bytes is outbound and Peer bytes is inbound.

 M.

[NetworkingGeek1]

@marce1000  Thank you for the reply. I also think like this. I just wanted to find any official document from Cisco or at least any other article to make sure.

[Georg Pauwen]

Hello,

I did a quite extensive search, hard to find anything at all that explains what 'Subject Bytes' actually are. I did find a document (see screenshot attached and link (click to the second slide). It looks like 'Subject' is the same as 'Host' and  'Peer' is the remote target. Which makes sense when one thinks about it logically I guess...

https://cisco.bravais.com/s/sGlVq9gK1COlRf8g7lgv

[NetworkingGeek1]

Hello @Georg Pauwen  Thank you. I wanted to find out what does 'Subject Bytes' mean for Subject in terms of if it's inbound or outbound traffic.