Skip to content
Start free

See who talks to whom across your network

Routers, switches and firewalls send NetFlow, IPFIX or sFlow to a collector on your own network. Flow analysis ranks the largest conversations and breaks them down by source, destination, port, autonomous system and country.

Start freeBook a demoRead the flow analysis docs
  • NetFlow v5 · v9
  • IPFIX · sFlow
  • AS and country

Country and AS data: IP Geolocation by DB-IP, licensed under CC BY 4.0.

How it works

From an exporter to a ranked conversation

Flow records travel only as far as a collector inside your network. The collector forwards them to your workspace over an outbound connection.

  1. 01ExportPoint NetFlow v5 or v9, IPFIX or sFlow from routers, switches and firewalls at a collector.
  2. 02ReceiveThe collector listens on UDP 2055 or 6343 and decodes each record with the OpenTelemetry NetFlow receiver.
  3. 03StoreRecords are stored with your logs, for as long as your data lifecycle rules keep them.
  4. 04EnrichCountry and AS are added when you query, from DB-IP data or the exporter's own AS fields.
  5. 05ExploreRank the largest conversations, then break them down by source, destination, port, AS and country.

Breakdowns

Break traffic down the way you investigate

Start from the conversations that move the most bytes, then see which sources, destinations, ports, networks and countries they add up to, for any range from five minutes to 30 days.

  • Top sources, destinations and ports, with source and destination counts
  • Traffic by autonomous system and country, and a map of where it goes
  • Filter by source or destination address and port

Collection

Flows stay on your network until a collector sends them

Each collector runs a flow listener next to your exporters, so devices never send flow data across the internet. The collector forwards decoded records to your workspace over HTTPS.

  • Three formats

    NetFlow v5 and v9 and IPFIX on UDP 2055, sFlow on 6343, or a port you choose.

  • Upstream receiver

    Records are decoded by the OpenTelemetry NetFlow receiver.

  • Enriched at query time

    Country and AS come from DB-IP data unless the exporter sends AS numbers.

  • Retention you set

    Flow records follow the data lifecycle rules of your workspace.

Records

Open any conversation down to the record

Every conversation opens to its five-tuple and both of its ends, each resolved to what Tracix knows about it: where it is, which network owns it, its reverse DNS name and any threat-intelligence match.

  • Addresses that belong to your devices, pods, collectors or cloud resources are named
  • Raw flow records show protocol, transport, packets, bytes and TCP state
  • Reverse DNS is skipped for addresses that match a threat indicator, so you never query an attacker's DNS

Better together

Traffic next to the devices and services it crosses

Flow records sit in the same workspace as device metrics, topology and service traces, so a busy link and the conversations on it are one search apart.

FAQ

Questions about flow data

Ask a network engineer
Can I group traffic by interface or exporter?
Not yet. Flow analysis groups by conversation, source, destination, port, autonomous system and country. Interface indexes and the exporter's address arrive with each record, but the page does not group on them yet.
Are sampled flows scaled back up?
Not yet. Bytes and packets are shown as the exporter sent them. The sampling rate arrives with each record, but it is not applied to the totals yet, so compare sampled exporters with each other rather than with interface counters.
How much of my traffic does the page rank?
The 100 largest conversations by bytes in the range you pick, and the counts, breakdowns and map are built from those. Only the bandwidth chart counts every record in the range.
Can I alert on flow data?
There are no ready-made flow monitors yet. Flow records are stored with your logs, so a custom SQL monitor can watch them, for example the bytes sent to one destination.

Send your first flows to a collector

Add the NetFlow / sFlow / IPFIX card to a collector policy, then point an exporter at UDP 2055 or 6343.

Start freeSet up flow collection