The IP 5-tuple is a collection of five features (protocol plus source and destination IP addresses and ports) that identify a TCP/IP connection. A tuple is immutable, which means that it's structure and its values cannot change (as opposed to a variable, even if the value doesn't change). The IP 5-tuple is unchanged throughout its journey from the source device to the destination device. This means that it can be tracked as it moves around the system. Where there are multiple network devices producing NetFlow data, for example, a packet can be seen traversing the network.

In this section, we will identify how the IP 5-tuple can be used to group events by host devices, and how we can isolate a compromised host in a grouped set of logs using this 5-tuple. This section relates to topics 4.3 and 4.4 of the 210–255 specification:

The IP 5-tuple is one of the most important tools for system and network administrators for tracking a packet through the system, and hence for identifying compromised host devices.