# Byte size in is bigger than real traffic packages in Network Explore

**URL:** <https://discuss.elastic.co/t/byte-size-in-is-bigger-than-real-traffic-packages-in-network-explore/328145>\
**Category:** Elastic Security\
**Created:** [March 21, 2023, 8:58am UTC](https://discuss.elastic.co/t/byte-size-in-is-bigger-than-real-traffic-packages-in-network-explore/328145 "2023-03-21T08:58:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![wishes9](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wishes9/32/118701_2.png) [@wishes9](https://discuss.elastic.co/u/wishes9)\
**Post date:** [March 21, 2023, 8:58am UTC](https://discuss.elastic.co/t/byte-size-in-is-bigger-than-real-traffic-packages-in-network-explore/328145/1 "2023-03-21T08:58:47Z")

</div>

elasticsearch-8.6.1  
kibana-8.6.1  
logstash-8.6.1

I install packetbeat in the VM which install elastic stack. When I try to use Security - Explore - Network in Kibana, I find that the traffice Bytes account is much more than real network traffice.

 ![explore](https://us1.discourse-cdn.com/elastic/original/3X/1/5/152f5064b3de918f4c593b677a2886261be0b373.png)

Then I try to check logs in Discover. I find for each source.port there is a log and there is a bytes\_in and bytes\_out. I don't know if "Security - Explore - Network" add all the bytes\_in or bytes\_out in each line of the log so make the value so large?

 ![packetbeet2](https://us1.discourse-cdn.com/elastic/original/3X/0/e/0e4b123e80ad0406c043d491dc4a6627129fb9c9.png)

---

<div class="post-metadata">

**Author:** ![machadoum](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/machadoum/32/107431_2.png) [@machadoum](https://discuss.elastic.co/u/machadoum)\
**Post date:** [March 22, 2023, 2:08pm UTC](https://discuss.elastic.co/t/byte-size-in-is-bigger-than-real-traffic-packages-in-network-explore/328145/2 "2023-03-22T14:08:59Z")

</div>

Hi, Wishes, and welcome to our community!

The Source and Destination table on the Network page does a sum aggregation on `destination.bytes` or `source.bytes` to calculate "Byten in" and "Bytes out". So it adds `destination.bytes` or `source.bytes` in each log line to calculate the total value.  
I simplified the query (for a fixed time range), making it easier to read and understand how the data is calculated.

```auto
GET packetbeat-*/_search
{
  "aggregations": {
    "source": {
      "terms": {
        "field": "source.ip",
        "size": 10,
        "order": {
          "bytes_in": "desc"
        }
      },
      "aggs": {
        "bytes_in": {
          "sum": {
            "field": "destination.bytes"
          }
        },
        "bytes_out": {
          "sum": {
            "field": "source.bytes"
          }
        }
      }
    }
  },
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp": {
              "gte": "2023-03-22T13:34:17.938Z",
              "lte": "2023-03-22T13:44:17.938Z",
              "format": "strict_date_optional_time"
            }
          }
        }
      ]
    }
  },
  "_source": false,
  "size": 0
}

```

Please; let me know if you need any further information.

---

<div class="post-metadata">

**Author:** ![wishes9](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wishes9/32/118701_2.png) [@wishes9](https://discuss.elastic.co/u/wishes9)\
**Post date:** [March 24, 2023, 3:38am UTC](https://discuss.elastic.co/t/byte-size-in-is-bigger-than-real-traffic-packages-in-network-explore/328145/3 "2023-03-24T03:38:22Z")

</div>

Hi Machadoum,

Thanks for your feedback. I know why the Bytes\_in and Bytes\_out in Security - Explore- Network is so large now.  
But I think the result in Security - Explore- Network is not true. Will Elastic change the way to count the "Byte In" and "Byte Out"? I think it's not good to do a sum aggregation on `destination.bytes` or `source.bytes` to calculate "Byten in" and "Bytes out"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2023, 3:38am UTC](https://discuss.elastic.co/t/byte-size-in-is-bigger-than-real-traffic-packages-in-network-explore/328145/4 "2023-04-21T03:38:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.