--- title: "Configuring Traffic Flows" canonical: "https://docs.infoblox.com/space/BloxOneCloud/35397475/Configuring%20Traffic%20Flows" format: markdown --- You can configure a Data Connector traffic flow that sends and receives data according to your business needs. Data Connector collects specified data, converts it into a specific format, and sends it to supported destinations. For Data Connector to function properly, you must define the type of data, the source from which Data Connector is to collect data, and the destination to which Data Connector is to transfer data. You can create different traffic flows for different purposes. For example, you can create a traffic flow in which Data Connector will collect DNS queries and response data from a NIOS appliance and will send this information to the NIOS Reporting Server. You can create another traffic flow, in which the same Data Connector will collect threat feeds and custom hits from Infoblox Threat Defense and will send the data to Splunk. Before you configure traffic flows for Data Connector, you must first enable the Data Connector service on the service instance and then set up sources and destinations that you want to use in the traffic flows. For more information, see *[Configuring Sources](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/35366317)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/35366317)and *[Configuring Destinations](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/35430092)*. > ℹ️ The provided information is for reference only. It represents the results of lab testing in a controlled environment focused on individual protocol services. Enabling additional protocols, services, cache hit ratio for recursive DNS, and customer environment variables will affect performance. To design and size a solution for a production environment, please contact your Infoblox Solution Architect. # Supported Traffic Flows The following table lists the sources, corresponding data types, and destinations that Data Connector supports: | **Sources** | **Data Types** | **Format** | **Destinations** | | --- | --- | --- | --- | | NIOS | - RPZ Log | - For a generic syslog, CEF (Common Event Format) and LEEF (Log Event Extended Format) are supported. - For Splunk, Splunk Cloud, and MS Sentinel, Infoblox Legacy and Splunk CIM formats are supported. - For NIOS Reporting, the CSV format is supported. - For Threat Insight, Parquet files via gRPC streaming are supported. - Only one traffic flow is supported for the Syslog, Splunk, Splunk Cloud, MS Sentinel, or NIOS Reporting destination. | - Infoblox Threat Defense Platform - MS Sentinel - NIOS Reporting - Splunk - Splunk Cloud - Syslog (generic) | | NIOS | - RPZ Log - IPAM Metadata | - Parquet files via gRPC streaming - The NIOS IPMeta configuration flow to Infoblox Destination requires at least 16 GB RAM size for servers where ipmeta flows are configured. If there are more frequent DB object updates then the RAM size needs to be further increased based on the DB size. It can be doubled to the previous memory resource limit ( i.e 16 * 2 = 32 GB ). | Infoblox Threat Defense Platform | | NIOS | - RPZ Log - Query - Response Log | | - HTTP (Splunk CIM / MS Sentinel Format) | | Infoblox Threat Defense | - Threat Defense Query/Response Log - Threat Defense Threat Feeds Hits Log - Audit Log - Internal Notifications
Streaming of data is close to real time. | For a generic syslog, CEF (Common Event Format) and LEEF (Log Event Extended Format) are supported.
For Splunk, Splunk Cloud, and MS Sentinel, Infoblox Legacy and Splunk CIM formats are supported.
For NIOS Reporting, the CSV format is supported.
Only one traffic flow is supported for the Syslog, Splunk, Splunk Cloud, or NIOS Reporting destination. | - MS Sentinel - NIOS Reporting - Splunk - Splunk Cloud - Syslog (generic) | | Universal DDI | DNS Query/Response Log | For a generic syslog, CEF (Common Event Format) and LEEF (Log Event Extended Format) are supported.
For Splunk, Splunk Cloud, and MS Sentinel, Infoblox Legacy and Splunk CIM formats are supported.
For NIOS Reporting, the CSV format is supported.
Only one traffic flow is supported for the Syslog, Splunk, Splunk Cloud, or NIOS Reporting destination. | - MS Sentinel - NIOS Reporting - Splunk - Splunk Cloud - Syslog (generic) | | Universal DDI | - DHCP Lease Log | For a generic syslog, CEF (Common Event Format) and LEEF (Log Event Extended Format) are supported. DHCP-enriched logs, including certain metadata, are sent in the CEF and LEEF formats.
For Splunk, Splunk Cloud, and MS Sentinel, Infoblox Legacy and Splunk CIM formats are supported. | - MS Sentinel - NIOS Reporting - Splunk - Splunk Cloud - Syslog (generic) | ## Viewing Traffic Flows To view traffic flows for Data Connector, do the following: 1. Log in to the Infoblox Portal. 2. Go to **Integrations** > **Data Connectors**. 3. Select the **Traffic Flow Configuration **tab. The Infoblox Portal displays the following for all traffic flow configurations: - **NAME**: The name of the source configuration. - **DESCRIPTION**: The information about the source configuration. - **SOURCE**: The filter criterion for the source process. When subscribing to a marketplace script obtained through the Infoblox Ecosystem, a default source configuration will populate the source field. - **DESTINATION**: The destination for the traffic flow. Multiple traffic flows of the same destination type (syslog and HTTP) to a single destination host are supported. - **LAST DELIVERED**: Date and time of last traffic flow delivery. - **ETL CONFIGURATION**: The description of the ETL configuration type. - **SERVICE INSTANCE**: The name of the service instance. Select a primary and secondary server from among the options in the drop-down menu. If the primary server becomes unresponsive or goes down, the secondary server in standby mode, takes over processing. Once the operational health of the primary server is restored, the secondary server re-enters standby mode. - **STATE**: An indication of whether the configuration is enabled or disabled. - **STATUS**: The current status of the traffic flow. The following status types are reported: - Active: A data pull is currently in progress. - Review Details: Review the details for the data pull. - Completed: A data pull has been completed on date and time. - Scheduled: A data pull is scheduled for date and time. - Disabled: A data pull has been disabled. ## Traffic Flow Configuration In the right-hand panel you can view the traffic flow configuration.  ## Filters Click the filter icon to open the filter options panel. traffic flow configuration filters can be applied based on *Name*, *Description*, *Source*, *Destination*, *ETL Configuration*, *Service Instance*, and *State*.  ## Search Use the search functionality (search box) to conduct a local search based on traffic flow criterion.  For additional information on configuring traffic flows in Data Connector, see the following: > Macro (children)