External destinations

The destinations view (/ziele, Destinations in the navigation) answers the question the globe only gestures at: which addresses outside this network did we talk to, and which of our devices did the talking?

It is a ranked page over the shared time window, not a scrollable collection. The default window is the last 15 minutes; the same time picker that drives the globe and the network map drives this page, so the three never disagree.

What counts as external

Only an address of class external — a routable address elsewhere on the internet — appears here. Everything else is excluded before it ever reaches the list: private ranges the site has or has not configured, loopback, link-local, carrier-grade NAT, the unspecified address, broadcast (including the broadcast address of your own configured VLAN prefixes), multicast (mDNS and SSDP among it), the reserved 240/4 block including 255.255.255.255, the documentation prefixes, and the IPv6 equivalents. An address of one of those classes has no row and no detail page.

The full list of classes, and why a broadcast address is not a destination anybody chose, is on address classes.

The one range that is deliberately not excluded is 198.18.0.0/15, the RFC 2544 benchmark range: a benchmark address in real traffic is a misconfiguration an operator should see, not one the product should hide.

The list

Each row is one destination in the window:

Column	Shows
Destination	The name, if one was observed, with the address beneath it; the linked incident count and highest score when the window has any
Country · network	Country code and ASN from the local GeoIP databases, or network unknown
Bytes	Out and in, from the internal side’s point of view
Flows	Distinct flows in the window
Devices	Internal devices resolved from the source addresses
Top protocols	Up to three protocol/port/service triples with their flow counts
Last seen	The last flow of the window

Sort by Bytes (the default), Flows or Devices with the switch above the list. Clicking a row opens the side sheet; the address goes into the URL (ziel=), so a destination is a link you can send to someone.

Two markers deserve a sentence each, because each could be misread:

• A tilde before a byte total means the sum is a sum over the flow versions the ingest path is still writing, and a merge is pending. It settles within a minute. Flow and device counts are exact either way, and so is every number in the detail.
• A plus after a device count means at least this many: the backend samples up to 100 source addresses per destination to fold them into devices, and more were seen. The source-address count itself is exact.

Filters

Filter	Applied
Country	By the API, against the local GeoIP database
Network (ASN)	By the API, against the local GeoIP database
Protocol	In the database: tcp, udp, icmp
Source VLAN	In the database — the VLAN of the internal side
Search (address, name)	By the API, a case-insensitive substring of the address or the observed name

The distinction matters for one notice. The database ranks a bounded candidate page (2,000 destinations) before the country, network and search filters are applied to it; when that page was full, the list says so and may be incomplete. Narrow the time window to be sure. An address the GeoIP database does not know never matches a country or network filter — absent enrichment is not a match.

The filters live in the URL as well (land, asn, protokoll, vlan, q, sortierung), so a filtered view is also a link.

Where the name comes from

The appliance runs no reverse-DNS resolver and keeps no answer-to-address mapping from the DNS events. The only truthful name for an external address is the one the client itself used on its connection to it: the TLS server name (SNI) or the HTTP host header, observed against that address. The list says which — from the TLS server name or from the HTTP host header — and never implies a DNS record. A destination with neither shows its address.

Names are kept for 30 days, the retention of the raw events they come from, which is shorter than the 90 days of flow data: a name is only ever shown next to a window, and beyond 30 days there is no event left to derive one from.

The side sheet

Opening a destination shows, for the same window:

• Head: the name with its source (or No name observed), the address, country and network, bytes out and in, flows, devices, first and last seen, and the threat-intelligence marker when a local list matched.
• Traffic per hour: one bar per UTC hour that had a flow, bytes out and in.
• Protocols and ports: the complete breakdown up to 500 protocol/port pairs.
• Devices: every internal device that reached this destination, with its addresses, VLANs, flows and bytes, up to 500 addresses. An address the inventory does not know keeps its address as its label.
• Incidents: the incidents of the window whose devices reached this destination, in the shape of the incident list, each a link into the incident dialog.
• Model results: the model results of those devices in the window, with model, score and reason.
• Observed names, when more than one was seen, each with its source, its observation count and its first and last sighting.

An external address is not a device and carries no score of its own. What the sheet shows under Incidents are the incidents of the devices that reached it, and the score in the list is the highest among them.

The detail is exact: it resolves the flow versions per flow, so nothing in it carries a tilde. If the protocol or device breakdown stopped at its bound, the sheet says so at the top. A single external address on more than 500 ports in one window is a port scan, and the sheet saying so is the point.

The only facts about the address itself come from the local GeoIP databases. There is no WHOIS lookup and no outbound request of any kind.

The overview tile

The overview carries a Top destinations tile in its Connections and countries sheet: the five largest destinations of the current window by bytes, each with its name or address, country code, bytes and flow count, and an All destinations link into this page. The tile sits in the sheet and not on the canvas on purpose — the sheet is an overlay over the globe, so the tile costs the globe no area. Tile and page read the same endpoint over the same window, so they can never disagree.

When the list is empty

Three ordinary reasons:

1. No external traffic in the window. The default window is 15 minutes.
2. No flow data yet, or the learning phase has only just started.
3. The summary tables were never backfilled. The page reads pre-aggregated tables that are filled by the ingest path from the moment the migration ran. ndr backfill-stats fills them for the retained history; without it the list is only as long as the tables’ own history — never wrong, only shorter. See upgrades.

API

GET /api/v1/destinations and GET /api/v1/destinations/{ip} — see the endpoint reference.