# NetFlow, IPFIX and sFlow

Receive NetFlow v5 and v9, IPFIX and sFlow from routers, switches and firewalls on a Tracix Collector, and see who talks to whom in Flow Analysis.

A Tracix Collector can receive the flow records your routers, switches and firewalls export, and **Flow Analysis** turns them into conversations, top talkers and traffic by location. One integration, **NetFlow / sFlow / IPFIX**, covers all three protocols.

## Supported protocols

| Protocol | Versions         | Default port |
| -------- | ---------------- | ------------ |
| NetFlow  | v5 and v9        | UDP 2055     |
| IPFIX    |                  | UDP 2055     |
| sFlow    | v5, flow samples | UDP 6343     |

NetFlow and IPFIX share one listener. sFlow uses its own, so receiving both takes two integrations on the policy. sFlow counter samples and vendor-specific fields aren't decoded.

## Set up flow collection

**1. Open the connect steps**

In your workspace, open **Collectors › Integrations** and select the **NetFlow / sFlow / IPFIX** tile, under **Network & Discovery**.

**2. Choose the collectors**

Flows go to your own collectors. Under **Where to add this integration**, pick the policy of the collectors your devices will export to, or create one.

**3. Choose the protocol and port**

Set **Flow protocol** to **NetFlow / IPFIX** or **sFlow**. Leave **Listen port** blank for the usual port, 2055 or 6343, or enter another.

**4. Connect**

Select **Review**, then **Connect**. Collectors on the policy open the port with their next revision of the policy.

**5. Point your devices at the collector**

Configure each device to export flows to a collector's address on that UDP port. Allow the port through the host's firewall: see [Ports, proxies and firewalls](https://tracix.io/docs/collect/collector/ports-and-proxies#inbound-ports).

> **Docker collectors need the port published**
>
> The console's Docker command publishes only the SNMP trap port. To receive flows on a Docker collector, add the port when you run it, such as `-p 2055:2055/udp`.

For a busy network, the advanced settings add listener **Sockets**, decoding **Workers** and a larger **Queue size**. **Send raw messages** skips decoding and stores each packet as is, for debugging.

## What each flow record holds

Each flow becomes a record with the source and destination address and port, transport protocol, bytes and packets, the exporter's address, the input and output interface indexes, the source and destination autonomous systems the exporter reports, the sampling rate, TCP flags and the flow type. The record's time is when the flow started.

## Flow Analysis

Open **Network › Flow Analysis**. Its tabs show the same flows several ways: **Overview**, **Conversation Partners**, **Traffic Analysis**, **Top-N**, **Geo Location**, **Flow Exporters**, **Connections** and **Raw Flow Records**. The time range starts at the last 15 minutes and goes back up to 30 days.

Tracix adds a location and an autonomous system to each public address when you query, from DB-IP's free databases. When the exporter reports its own AS numbers, those win. Addresses in private ranges count as internal.

Keep these limits in mind when you read the numbers:

* **Sampled flows aren't scaled up.** Bytes and packets are the totals the exporter sent. If a device samples one packet in 1,000, the traffic shown is about one thousandth of the real traffic.
* **Interfaces are indexes.** Flow records carry interface numbers; Flow Analysis doesn't show the names SNMP knows for them.
* **Applications are transport protocols.** Flow Analysis has no deep packet inspection, so traffic is grouped by protocol and port, not by application.
* **The conversation list shows the top 100** by bytes in the time range.

IP geolocation by [DB-IP](https://db-ip.com), licensed under CC BY 4.0.

## Next steps

- [Flow analysis](https://tracix.io/docs/network/flow-analysis): Investigate traffic in Flow Analysis

- [SNMP polling and traps](https://tracix.io/docs/collect/network-data/snmp): Add device and interface metrics

- [Ports, proxies and firewalls](https://tracix.io/docs/collect/collector/ports-and-proxies): Open the flow ports