Traffic Flows and Traffic Logging in UniFi Network

Traffic Flows in UniFi Network provide detailed traffic logs of all network activity passing through your UniFi Gateway. These logs offer critical visibility for network traffic analysis, security monitoring, and troubleshooting connectivity issues.

For a full overview of UniFi's Network and Cyber Security capabilities, see here.

For a full overview of UniFi’s Traffic and Policy Management capabilities, see here.

Overview of Traffic Flow information

To access Traffic Flows, go to Insights > Flows in the UniFi Network application. This opens a table view showing completed network sessions that have passed through your UniFi Gateway. Key information displayed includes:

• Source & Destination Ports
• Blocked and Allowed Traffic
• Risk Level
• Policies Applied (Intrusion Prevention, Content Filtering, NAT, Traffic Routes, etc.)
• Detailed Traffic Analytics (bytes transferred, session duration, etc.)

Clicking on a flow will open a property panel which displays all data relevant to the traffic flow.

Custom Views and Filters

You can tailor the traffic table to fit your workflow by adding columns for any available data points. To narrow your focus, apply filters to individual columns by clicking the magnifying glass icon in the column header and selecting from the available values.

Once you’ve configured a useful combination of columns and filters, you can save it as a custom view. This allows you to return to the same filtered view at any time, without needing to reapply settings.

UniFi also includes several preset views to help you get started, including:

• All Flows
• Blocked
• Threats
• NeXT AI

These views are designed to help you quickly focus on key traffic categories.

Log Retention

The quantity of logs retained is determined on your UniFi Gateway and/or UniFi Host. The table below shows an estimate:

Exporting Logs

UniFi offers several methods of log export in order to maintain long-term retention. This includes:

• CSV Export: Navigate to Insights > Flows and click the Export button in the top-right corner.
• NetFlow (IPFIX): Navigate to Settings > System > Traffic Logging > enable NetFlow (IPFIX) to send sampled traffic data to a third-party SIEM or collection server.

SIEM Export: Navigate to Settings > Control Plane > Integrations > select SIEM Server as the destination for Activity Logging. Traffic Logs will be made available for SIEM integration in a future release.