What is NetFlow, and how do you use it to analyse traffic?
NetFlow and IPFIX explained: how they differ from SNMP, what traffic analysis is good for — top talkers, capacity, troubleshooting, security — and how to set it up.
SNMP tells you the internet link is 90% full. The next question is always who is filling it. That's what NetFlow answers.
What is NetFlow?
NetFlow lets a router or firewall report a summary of the traffic passing through it. Each flow is a set of packets with the same source, destination, ports and protocol; the device records bytes, packets and timing per flow and exports them to a collector.
The common formats are NetFlow v5 (simple, IPv4 only), NetFlow v9 (template-based, IPv6-capable) and IPFIX (the IETF standard based on v9). Many vendors, including MikroTik as “Traffic Flow”, support one of them.
NetFlow vs SNMP
| SNMP | NetFlow / IPFIX | |
|---|---|---|
| Tells you | Total traffic per interface | Who talks to whom, on which port |
| Detail | Low | High (per conversation) |
| Main use | Link usage and state | Traffic analysis, troubleshooting, security |
What traffic analysis is good for
- Top talkers: which users, servers or applications use the most bandwidth.
- Capacity planning: each link's growth trend, to time upgrades.
- Troubleshooting: finding the cause of sudden slowness — say, a backup running in business hours.
- Security: scan patterns, unusual ports and suspicious outbound volume that may indicate exfiltration.
Setting up NetFlow
- On your edge router or firewall, export NetFlow v9 or IPFIX to the collector's IP.
- Choose the key interfaces (internet, WAN).
- Make sure the collector's UDP port is open.
- After a few hours, review top talkers and trends.
Conclusion
NetFlow and IPFIX give deep traffic visibility with no extra hardware. BehMon traffic analysis collects v5, v9 and IPFIX, shows top talkers and history, and runs four suspicious-behaviour detectors on the same data.