# Netflow v9 upload bytes and download bytes

**URL:** <https://discuss.elastic.co/t/netflow-v9-upload-bytes-and-download-bytes/296951>\
**Category:** Elasticsearch\
**Created:** [February 11, 2022, 8:59am UTC](https://discuss.elastic.co/t/netflow-v9-upload-bytes-and-download-bytes/296951 "2022-02-11T08:59:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![111401](https://avatars.discourse-cdn.com/v4/letter/1/e19b73/32.png) [@111401](https://discuss.elastic.co/u/111401)\
**Post date:** [February 11, 2022, 8:59am UTC](https://discuss.elastic.co/t/netflow-v9-upload-bytes-and-download-bytes/296951/1 "2022-02-11T08:59:27Z")

</div>

Hi all,  
I have configured netflow v9 and try to use elk to monitor the upload and download bytes.  
I tried to upload the file (4MB) from local (192.168.x.x ) to the ftp server (211.x.x.x),  
log is like this

 ![Screen Shot 2022-02-11 at 4.17.26 PM](https://us1.discourse-cdn.com/elastic/original/3X/8/e/8e5e99105012927396ee0a3450c03715acc99760.png)

Conversely, I download the same file from ftp server to my local computer, the log is like this

 ![Screen Shot 2022-02-11 at 4.30.26 PM](https://us1.discourse-cdn.com/elastic/original/3X/7/5/75f543d187420d003e8c8564c1942a9016f61bf4.png)

The first question:  
Is the number of field `netflow.post_octet_delta_count` be the transmission bytes of this file? If so, what is source.bytes and network bytes means?

The second question:  
I mentioned that I do the upload and download action between these two ip 192.168.x.x and 211.x.x.x, but no matter upload or download, the source ip always be 192.168.x.x and destination ip always be 211.x.x.x, how can I distinguish the record is about upload or download? (Because I have to represent a graph of both)

Thanks for any advices.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2022, 9:00am UTC](https://discuss.elastic.co/t/netflow-v9-upload-bytes-and-download-bytes/296951/2 "2022-03-11T09:00:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.