diff --git a/cli/cmd/network_report.go b/cli/cmd/network_report.go
index fbe0ac828..d1498b39a 100644
--- a/cli/cmd/network_report.go
+++ b/cli/cmd/network_report.go
@@ -47,6 +47,7 @@ replicated network report <network-id> --watch`,
 
 	cmd.Flags().BoolVarP(&r.args.networkReportWatch, "watch", "w", false, "Watch for new network events in real-time (polls every 2 seconds)")
 	cmd.Flags().BoolVar(&r.args.networkReportSummary, "summary", false, "Get aggregated report summary with statistics instead of individual events")
+	cmd.Flags().BoolVar(&r.args.networkReportShowExternalOnly, "show-external-only", true, "Show only external network traffic")
 
 	return cmd
 }
@@ -68,6 +69,11 @@ func (r *runners) getNetworkReport(cmd *cobra.Command, args []string) error {
 
 	// Don't call getNetworkIDFromArg here. Reporting API supports short IDs and will also work for networks that have been deleted.
 
+	// Validate flags
+	if r.args.networkReportSummary && cmd.Flags().Lookup("show-external-only").Changed {
+		return fmt.Errorf("cannot use --show-external-only and --summary flags together")
+	}
+
 	// Get the initial network report or summary depending on args provided
 	if r.args.networkReportSummary {
 		return r.getNetworkReportSummary(cmd.Context())
@@ -77,7 +83,7 @@ func (r *runners) getNetworkReport(cmd *cobra.Command, args []string) error {
 }
 
 func (r *runners) getNetworkReportEvents() error {
-	report, err := r.kotsAPI.GetNetworkReport(r.args.networkReportID)
+	report, err := r.kotsAPI.GetNetworkReport(r.args.networkReportID, r.args.networkReportShowExternalOnly)
 	if errors.Cause(err) == platformclient.ErrForbidden {
 		return ErrCompatibilityMatrixTermsNotAccepted
 	} else if err != nil {
@@ -111,9 +117,9 @@ func (r *runners) getNetworkReportEvents() error {
 		for range time.Tick(2 * time.Second) {
 			var newReport *types.NetworkReport
 			if lastEventTime != nil {
-				newReport, err = r.kotsAPI.GetNetworkReportAfter(r.args.networkReportID, lastEventTime)
+				newReport, err = r.kotsAPI.GetNetworkReportAfter(r.args.networkReportID, lastEventTime, r.args.networkReportShowExternalOnly)
 			} else {
-				newReport, err = r.kotsAPI.GetNetworkReport(r.args.networkReportID)
+				newReport, err = r.kotsAPI.GetNetworkReport(r.args.networkReportID, r.args.networkReportShowExternalOnly)
 			}
 
 			if err != nil {
diff --git a/cli/cmd/runner.go b/cli/cmd/runner.go
index a3847929a..a62e6eb04 100644
--- a/cli/cmd/runner.go
+++ b/cli/cmd/runner.go
@@ -254,9 +254,10 @@ type runnerArgs struct {
 	lsNetworkEndTime        string
 	lsNetworkWatch          bool
 
-	networkReportID      string
-	networkReportWatch   bool
-	networkReportSummary bool
+	networkReportID               string
+	networkReportWatch            bool
+	networkReportSummary          bool
+	networkReportShowExternalOnly bool
 
 	updateNetworkPolicy        string
 	updateNetworkCollectReport bool
diff --git a/pkg/kotsclient/network_report.go b/pkg/kotsclient/network_report.go
index 63a69080a..f2c5d04a1 100644
--- a/pkg/kotsclient/network_report.go
+++ b/pkg/kotsclient/network_report.go
@@ -11,15 +11,18 @@ import (
 	"github.com/replicatedhq/replicated/pkg/types"
 )
 
-func (c *VendorV3Client) GetNetworkReport(id string) (*types.NetworkReport, error) {
-	return c.GetNetworkReportAfter(id, nil)
+func (c *VendorV3Client) GetNetworkReport(id string, showExternalOnly bool) (*types.NetworkReport, error) {
+	return c.GetNetworkReportAfter(id, nil, showExternalOnly)
 }
 
-func (c *VendorV3Client) GetNetworkReportAfter(id string, after *time.Time) (*types.NetworkReport, error) {
+func (c *VendorV3Client) GetNetworkReportAfter(id string, after *time.Time, showExternalOnly bool) (*types.NetworkReport, error) {
 	urlPath := fmt.Sprintf("/v3/network/%s/report", id)
+	v := url.Values{}
 	if after != nil {
-		v := url.Values{}
 		v.Set("after", after.Format(time.RFC3339Nano))
+	}
+	v.Set("show-external-only", fmt.Sprintf("%t", showExternalOnly))
+	if len(v) > 0 {
 		urlPath = fmt.Sprintf("%s?%s", urlPath, v.Encode())
 	}