Conversation Mode

Secure Workload supports the following flow analysis fidelity modes:

• Detailed Mode: The Detailed Mode captures every observed flow by the agent along with detailed statistics. Statistics captured are packet and byte counts, TCP flags, connection statistics, network latency, SRTT, and so on. While this type of reporting is desirable in numerous cases, it is computationally intensive to report and process the data. Additionally, it may not be strictly required when the primary use case is segmentation.

• Conversations Mode: The Conversations Mode offers a more lightweight alternative to the traditional detailed mode. Agents in conversations mode aim to report conversations as opposed to flows during the client-server classification. This is applicable to TCP, UDP, and ICMP flows.

In the detailed mode, for TCP/UDP flows, report 5-tuple flows (source and destination IP, source and destination port, and protocol). While for conversations mode, the agent omits the source port as they are ephemeral ports (changes on every new connection), making it a 4-tuple flow.

Detecting a flow as 4-tuple also depends on client-server detection algorithms, which relies on the server/destination port being a well-known port (0–1023).

Thus, if you’re using a custom application which doesn’t use well-known server/destination ports, the OpenAPI interface can be used to punch well-known server ports. These configs are not applied to past flows, and only affect markings on flows from that point on (that is, going forward). To optimize server ports, see Client Server Configuration.

Agent reports in conversations mode contain trimmed down information, full list of omitted fields includes:

• TCP/UDP source port (ephemeral ports)

• Fwd/Rev TCP bottleneck

• TCP handshake bucket

• SRTT(µs)

• Fwd/Rev Packet retransmissions

• SRTT Available

• Fwd/Rev Congestion Window Reduced

• Fwd/Rev MSS Changed

• Fwd/Rev TCP Rcv Window Zero? Fwd/Rev Burst Indicator

• Fwd/Rev Max Burst Size (KB)

To enable conversations mode, see the Flow Visibility config section in: Software Agent Config

The exact benefit gained by changing agents to report in conversation mode may vary due to multiple factors, including, but not limited to percentage of TCP flows, number of services listening on well-known service ports, and memory limitations at the agent.

After turning on conversations mode for some agents, there may be a mixture of conversations and flows in the observations on the flow search page.