Read Virtual Network flow counters as interval contributions

Source facts

For Continuing and End flow states, Virtual Network flow-log byte and packet values cover the interval since the previous tuple record. Microsoft calculates a conversation total by adding those contributions, rather than treating the final record as the entire conversation.

A Begin record has no statistics. Sent and received counters are separate, and byte counts include packet headers as well as payload. These distinctions matter when defining the report’s total. Microsoft Learn.

Applicability

Review the parser’s flow identity, ordering, state handling, and direction labels. State whether the intended metric is one-way traffic, both directions, or application payload; do not silently treat those measurements as interchangeable.

DSE recommendation

DSE recommends a small documented fixture containing Begin, Continuing, and End records. Specify the expected contribution from each record and how duplicate or missing input is handled. Keep incomplete sequences visible in the report rather than inventing counters for absent intervals. Preserve the raw record reference for each aggregate.

Verification

Run the fixture through the actual ingestion and reporting path. Compare directional sums with the expected values, then repeat with a duplicated record, a missing continuation, and an empty Begin record. Confirm that the report distinguishes known totals from incomplete observations and does not equate wire bytes with payload size.

Official references

Microsoft Learn: Virtual Network Flow Logs. Source retrieved September 9, 2026.