Skip to content
Docs

    • Linux · macOS · Windows · Kubernetes · Docker

    NetFlow, IPFIX and sFlow

    3 min read · Updated View as Markdown

    A Tracix Collector can receive the flow records your routers, switches and firewalls export, and Flow Analysis turns them into conversations, top talkers and traffic by location. One integration, NetFlow / sFlow / IPFIX, covers all three protocols.

    Supported protocols

    ProtocolVersionsDefault port
    NetFlowv5 and v9UDP 2055
    IPFIXUDP 2055
    sFlowv5, flow samplesUDP 6343

    NetFlow and IPFIX share one listener. sFlow uses its own, so receiving both takes two integrations on the policy. sFlow counter samples and vendor-specific fields aren't decoded.

    Set up flow collection

    1. Open the connect steps

      In your workspace, open Collectors › Integrations and select the NetFlow / sFlow / IPFIX tile, under Network & Discovery.

    2. Choose the collectors

      Flows go to your own collectors. Under Where to add this integration, pick the policy of the collectors your devices will export to, or create one.

    3. Choose the protocol and port

      Set Flow protocol to NetFlow / IPFIX or sFlow. Leave Listen port blank for the usual port, 2055 or 6343, or enter another.

    4. Connect

      Select Review, then Connect. Collectors on the policy open the port with their next revision of the policy.

    5. Point your devices at the collector

      Configure each device to export flows to a collector's address on that UDP port. Allow the port through the host's firewall: see Ports, proxies and firewalls.

    Docker collectors need the port published

    The console's Docker command publishes only the SNMP trap port. To receive flows on a Docker collector, add the port when you run it, such as -p 2055:2055/udp.

    For a busy network, the advanced settings add listener Sockets, decoding Workers and a larger Queue size. Send raw messages skips decoding and stores each packet as is, for debugging.

    What each flow record holds

    Each flow becomes a record with the source and destination address and port, transport protocol, bytes and packets, the exporter's address, the input and output interface indexes, the source and destination autonomous systems the exporter reports, the sampling rate, TCP flags and the flow type. The record's time is when the flow started.

    Flow Analysis

    Open Network › Flow Analysis. Its tabs show the same flows several ways: Overview, Conversation Partners, Traffic Analysis, Top-N, Geo Location, Flow Exporters, Connections and Raw Flow Records. The time range starts at the last 15 minutes and goes back up to 30 days.

    Tracix adds a location and an autonomous system to each public address when you query, from DB-IP's free databases. When the exporter reports its own AS numbers, those win. Addresses in private ranges count as internal.

    Keep these limits in mind when you read the numbers:

    • Sampled flows aren't scaled up. Bytes and packets are the totals the exporter sent. If a device samples one packet in 1,000, the traffic shown is about one thousandth of the real traffic.
    • Interfaces are indexes. Flow records carry interface numbers; Flow Analysis doesn't show the names SNMP knows for them.
    • Applications are transport protocols. Flow Analysis has no deep packet inspection, so traffic is grouped by protocol and port, not by application.
    • The conversation list shows the top 100 by bytes in the time range.

    IP geolocation by DB-IP, licensed under CC BY 4.0.

    Next steps

    Flow analysisInvestigate traffic in Flow AnalysisSNMP polling and trapsAdd device and interface metricsPorts, proxies and firewallsOpen the flow ports
    Report a problem with this page