Metadata about network connections (source/destination IP, ports, bytes, duration) - Much smaller than full packet capture - Sufficient for many investigations - Tools: ntopng, SiLK, Elastiflow