Network session analytics

import { Render } from "~/components";
The Network session analytics dashboard provides visibility into your Cloudflare One traffic patterns. This dashboard helps you understand how traffic flows through your network, including on-ramps (how traffic enters Cloudflare, such as the Cloudflare One Client, proxy endpoints (PAC files), Browser Isolation, Cloudflare Mesh, Workers VPC, or Cloudflare Tunnel) and off-ramps (how traffic exits Cloudflare, such as the public Internet, a Cloudflare Tunnel, or a Mesh node).
The dashboard is based on the Zero Trust network sessions Logpush dataset. For definitions on any field, refer to the dataset schema documentation.
To review Network session analytics:
In the Cloudflare dashboard, go to Zero Trust > Insights > Dashboards.
Select Network session analytics.
Use cases
The Network session analytics dashboard helps you:
Understand traffic patterns: Visualize how traffic flows through your network infrastructure.
Monitor bandwidth usage: Track upload, download, and total bytes transferred across your network.
Identify connection issues: Analyze connection close reasons to troubleshoot network problems.
Track user and device activity: Monitor unique users and devices accessing your network.
Provided analytics
Summary metrics
Session count: Total number of network sessions. Each session represents an individual TCP, UDP, ICMP, or ICMPv6 flow that passes through Gateway.
Bytes total: Total bytes transferred (upload + download)
Unique users: Number of distinct users
Traffic by location
World map: Geographic visualization of network traffic by the Cloudflare data center where traffic entered the network (ingress) and where it exited (egress)
Location list: Top Cloudflare data center locations by ingress and egress session count with accompanying graph
Change: Shows the total change across ingress and egress for each location
Top analytics
Top protocols: Most used network protocols (TCP, UDP, ICMP, ICMPv6)
Top connection close reasons: Common reasons for session termination:
Client closed
Origin closed
Client idle timeout
Client error
Unknown
Client TLS error
Origin unreachable
Too many new sessions for user
Origin TLS error
Origin unroutable
For the full list of reasons for session termination, refer to ConnectionCloseReason.
Troubleshoot session limit errors
Session limit close reasons identify the type and scope of a limit. Reasons containing 
ACTIVE_SESSIONS indicate too many concurrent sessions. Reasons containing 
NEW_SESSIONS indicate that sessions are being created too quickly. 
FOR_ACCOUNT reasons aggregate sessions for the account on the Cloudflare server enforcing the limit and can affect multiple users connected to that server. 
FOR_USER reasons apply to one user.
Use Zero Trust Network Session Logs, not Gateway activity logs, to investigate these errors. Filter by 
ConnectionCloseReason, then correlate 
SessionStartTime and 
SessionID with fields such as 
Email, 
UserID, 
DeviceID, 
SourceIP, 
OriginIP, 
OriginPort, 
Protocol, and 
ConnectionReuse.
Reduce automatic retries and connection churn in the affected application. Reuse connections when the application and protocol support it. If expected sustained traffic continues to produce these errors, contact your account team or Cloudflare Support for review.
Related resources
Zero Trust network sessions Logpush dataset: View detailed logs for individual network sessions.
Gateway network policies: Configure policies that apply to network traffic.