Explore

Explore is where you analyze stored traffic. It has one toolbar for the whole page: direction (All, Inbound, Outbound), the filter, the time range and the metric (bits, packets or flows). Switching tabs keeps them.

Tabs

Tab	Shows
Over time	Traffic over the range, broken down by a dimension you choose (application, protocol, AS, country, interface, hostgroup and more)
Top talkers	The top values of a dimension, with averages and peaks. Includes Our prefixes: each of your networks with its traffic now, peak and average, larger networks unfolded into /24s (IPv6: /48s)
ASNs	The top 50 remote ASes, and a search for any AS
Flow records	The raw records, newest first, with CSV export
Paths	A Sankey diagram from remote AS through your upstream interfaces to hostgroups
World map	Traffic by country
Hour of week	A heat map of when traffic peaks
Packet sizes	A histogram of average packet size per flow record

Heimnull picks the data for each query: raw flow records for recent ranges and detailed questions, 1-minute and 1-hour rollups for longer ranges. Raw flows are kept 30 days by default; rollups much longer. See Storage and retention.

Save stores the page’s filter, range and tab as a saved view, for you alone.

The filter

Build a filter with the query builder, or type it. Adjacent conditions are joined with and; use or, not (or !) and parentheses for the rest.

dst 203.0.113.5 and proto udp and sport 123
src net 198.51.100.0/24 or (app QUIC and not country US)
remote as 15169 port 443,853 bytes > 1000

A comma between values means “any of these”. Numbers compare with =, !=, <, <=, > and >=.

Field	Matches
src_ip, dst_ip, ip	An address or prefix: source, destination, either
local_ip, remote_ip	Your side or the remote side of the flow
local_host_ip	Your host behind NAT, where Heimnull knows it
src_port, dst_port, port, service_port	Ports; service_port is the server side’s
proto	Protocol by name or number (tcp, udp, icmp, 47)
src_as, dst_as, as, remote_as	AS numbers
country, src_country, dst_country	Two-letter country codes
app, service, company, category	Application labels. app matches the label or the protocol under it (app QUIC also finds YouTube over QUIC); service the protocol only
iface, in_iface, out_iface, ext_iface	Interfaces; ext_iface is the one facing the internet
exporter, hostgroup	By name
direction	in, out, internal or transit
prefix	The remote routed prefix
tcp_flags, dscp, pkt_size, ip_version	Header fields
bytes, packets	Per record
app_method	How the application was identified: rule, endpoint, provider, asn, port, ptr, heuristic, or none

Friendlier forms work too. ip, host, net, port, as and country take a qualifier in front: src, dst, local or remote (src net 198.51.100.0/24, remote as 15169), and src or dst alone takes an address. Also sport and dport, protocol, asn, cat for category, interface, in-iface, out-iface, upstream for the internet-facing interface, dir, flags, group for hostgroup and nat-host for the host behind NAT. Names (interfaces, exporters, applications, hostgroups) are looked up for you.

The value menu

Every address, AS, application, port, country, interface or prefix in a table, list or flow record opens the same menu:

• Open its page (the host, AS, prefix, application, country, interface or exporter page);
• Show only this and Exclude this, which add to the filter;
• Flow records for it;
• Copy.

The time range

The range you choose follows you between pages in the same browser tab: open a host from a spike and its page keeps that window. Dragging across a chart opens the range inspector; “Zoom the page to this range” zooms in.

Global search

Ctrl+K (Cmd+K) anywhere, or the search box: addresses (host page, flow records, attacks), prefixes, AS numbers and names, applications and categories, interfaces, exporters, hostgroups, countries, host names and pages.