# Flow analysis

Send NetFlow v5 or v9, IPFIX or sFlow to a Tracix Collector and explore the largest conversations by source, destination, port, country and autonomous system.

Routers, switches and firewalls can export flow records to a Tracix Collector on your network. This page shows how to receive them and how to read **Flow Analysis**.

## Supported flow formats

| Format                   | Integration setting                | Default UDP port |
| ------------------------ | ---------------------------------- | ---------------- |
| NetFlow v5 and v9, IPFIX | **Flow protocol**: NetFlow / IPFIX | 2055             |
| sFlow                    | **Flow protocol**: sFlow           | 6343             |

One integration listens for one protocol. To receive both NetFlow or IPFIX and sFlow, add the integration twice, once per protocol.

## Receive flows

**1. Add the flow integration**

Add the **NetFlow / sFlow / IPFIX** integration to the policy of a collector your exporters can reach. Choose the **Flow protocol**, and leave **Listen port** empty to use the protocol's usual port. Adding integrations needs permission to manage them, which admins have by default; see [Manage collectors with policies](https://tracix.io/docs/collect/collector/policies).

**2. Open the port on the collector host**

Allow inbound UDP on the listen port, 2055 or 6343 by default, from your exporters' addresses in the host firewall and any security group. See [Endpoints and ports](https://tracix.io/docs/reference/endpoints-and-ports).

**3. Point your exporters at the collector**

On each router, switch or firewall, set the flow export destination to the collector's address and the listen port. Exporter configuration is vendor specific; [NetFlow, IPFIX and sFlow](https://tracix.io/docs/collect/network-data/flows) has the details.

**4. Check that records arrive**

Open **Network › Flow Analysis**. Until the first record arrives, the page shows **Waiting on flow exports**. When records exist but none fall in the selected time range, widen the range.

## Read Flow Analysis

The page reads the flow records in the selected time range, the last 15 minutes by default. It groups them into conversations, one for each source and destination address, ports and protocol, and keeps the 100 largest by bytes. Every view on the page, including the totals at the top, is built from those 100 conversations, plus a traffic chart over the whole range.

> **Totals cover the largest conversations only**
>
> Because the page keeps the 100 largest conversations, its byte totals and averages describe those conversations, not all of your traffic. Narrow the time range or filter by address or port to look at smaller flows.

| Tab                       | What it shows                                                                                                                                                                             |
| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Overview**              | Counts of sources, destinations and ports; top sources, destinations and ports by bytes and by packets; top countries and autonomous systems on each side; and a heat map of destinations |
| **Conversation Partners** | Each conversation with its source, destination, application, packets and bytes                                                                                                            |
| **Traffic Analysis**      | Traffic over the whole time range, and the sources and destinations that sent the most packets                                                                                            |
| **Top-N**                 | Top sources, destinations and applications by bytes                                                                                                                                       |
| **Geo Location**          | A map of the traffic, with countries and cities on each side                                                                                                                              |
| **Connections**           | A graph of which endpoints talk to which                                                                                                                                                  |
| **Raw Flow Records**      | Each conversation as a row, with its protocol, transport, packets, bytes and TCP state                                                                                                    |

Filter every tab by source or destination address and port with the filter bar under the tabs. Select a conversation or record to open its details. Conversations whose TCP flags include a reset are counted under **Anomalies** at the top of the page.

Countries, cities and autonomous systems come from the flow record when the exporter includes them, and otherwise from Tracix's IP geolocation data. Private addresses show as **Internal**. IP geolocation by [DB-IP](https://db-ip.com), licensed under CC BY 4.0.

The application shown for a conversation is the protocol or application name the record carries, and otherwise its transport, such as `tcp` or `udp`.

> **Not yet**
>
> Flow Analysis doesn't group traffic by interface or by exporter, and it doesn't scale sampled records by their sampling rate: bytes and packets show as the exporter sent them. Per-interface traffic from SNMP is on each device's **Traffic** and **Interfaces** tabs; see [Devices and SNMP profiles](https://tracix.io/docs/network/devices).

## Next steps

- [NetFlow, IPFIX and sFlow](https://tracix.io/docs/collect/network-data/flows): Exporter settings and listener options

- [Discovery and topology](https://tracix.io/docs/network/discovery-topology): See how the devices behind the traffic connect

- [Monitors](https://tracix.io/docs/alerting/monitors): Alert on the metrics and logs you collect