// Module included in the following assemblies:
//
// * observability/network_observability/network-observability-monitoring-tls-traffic.adoc

:_mod-docs-content-type: PROCEDURE
[id="network-observability-analyze-tls-traffic_{context}"]
= Analyze Transport Layer Security traffic data

[role="_abstract"]
View and filter Transport Layer Security (TLS) metadata to identify deprecated configurations and verify encryption compliance in the cluster.

.Prerequisites

* The Network Observability Operator is installed.
* TLS tracking is enabled in the `FlowCollector` custom resource (CR).
* Access to the {product-title} web console.

.Procedure

. Navigate to *Observe* -> *Network Traffic* in the {product-title} web console and click the *Traffic flows* tab.
+
[NOTE]
====
The *TLS Version* column is enabled by default. If the default TLS version column is not visible after enabling TLS tracking, click *Restore default columns* in *Manage columns* to refresh the table.
====

. Add TLS-specific columns to the traffic table:
.. Click *Manage columns*.
.. Select the *TLS Cipher Suite*, *TLS Group*, and *TLS Types* checkboxes.
.. Click *Save*.

. Filter traffic by message type to view complete TLS metadata:
.. In the filter bar, select *TLS Types* and choose *ServerHello* from the dropdown menu.
+
`ServerHello` messages contain negotiated TLS metadata such as cipher suite and cryptographic group information.

. Filter traffic by TLS version to identify deprecated configurations:
.. In the filter bar, select *TLS Version*.
.. Select the versions you want to review:
* *1.0*: Deprecated
* *1.1*: Deprecated
* *1.2*: Legacy
* *1.3*: Current standard
+
To identify all deprecated connections, filter for TLS versions 1.0 and 1.1.

. Analyze TLS metrics in the overview panel:
.. Click the *Overview* tab.
.. Review the default TLS panels, which include *TLS usage (network flows per second)* and *TLS per version (network flows per second)*.
.. Optional: To view additional TLS metrics, click *Manage panels* to select and display additional panels, such as *TLS per group (network flows per second)* or *TLS per cipher suite (network flows per second)*.

. Identify secure connections in the *Topology* view:
.. Click the *Topology* tab.
+
Connections secured with TLS are marked with a lock icon. The color of the lock icon indicates the security level:
+
* *Red*: Deprecated TLS versions (1.0 or 1.1)
* *Yellow*: Legacy configurations (TLS 1.2)
* *Green*: Secure connections (TLS 1.3)
* *Blue*: Post-Quantum Cryptography (PQC) compliant
+
Select a connection node to view its specific TLS version and cipher suite details.

. View TLS metrics in the Network Observability dashboard:
.. Navigate to *Observe* -> *Dashboards*.
.. Search for *NetObserv* and review the available metrics:
* *TLS Traffic*: Displays overall TLS traffic metrics.
* *Flows rate per TLS version*: Displays traffic trends by TLS version over time.
* *Flows rate per TLS group*: Displays traffic by TLS group over time.
