Traffic analysis with NetFlow and IPFIX

Ping and SNMP tell you a link is busy. Flow data tells you why: which computer, talking to which service, over which application. Routers, firewalls and some switches can send a short record for every conversation to the collector, which adds them up into the Traffic tab. Switches that send sFlow fill the same tab: see the sFlow guide.

Turn it on

1. On the collector, open Settings › NetFlow and tick Receive NetFlow v5, v9 and IPFIX from routers and firewalls. The collector listens on UDP 2055 unless you pick another port under More settings.
2. Under More settings, enter the addresses of your routers or firewalls in Accept flows only from these sources, so nothing else can send data, and choose Save.
3. Point each router or firewall at the collector's address and port. Send flows here shows ready-to-paste Cisco commands with your collector's address filled in.
4. Within a minute or two the router appears under Flow sources, and the Traffic tab fills up.

ip flow-export version 9
ip flow-export destination <collector-ip> 2055
ip flow-cache timeout active 1
interface GigabitEthernet0/0
 ip flow ingress

Turn on ip flow ingress on every routed interface (LAN, WAN, sub-interfaces and tunnels) and no egress, so each packet is reported once.

Tip: Cisco routers can export to two destinations, so an existing flow tool keeps receiving while you try Monitaria. Set the active timeout to one minute, or long downloads only show up when they finish.

FortiGate, SonicWall (AppFlow), Meraki, MikroTik, pfSense and OPNsense (softflowd) all export NetFlow v9 or IPFIX. Sampled exports are scaled back up automatically when the exporter reports its sampling rate; otherwise set it per exporter.

Reading the Traffic tab

• Traffic over time: select a bar to see what happened in those minutes.
• Top talkers: every address with what it sent and received. Internal hosts that send far more than they receive are marked mostly uploading, which is how backups, cloud sync and data leaving the network stand out.
• Applications: traffic by protocol and service port (HTTPS, QUIC, SMB, Remote Desktop, iSCSI and so on).
• Top conversations: who talked to whom, over which application.
• Select any address to see only its traffic and the hosts it talks to. Names come from your monitored devices, then reverse DNS, and the owner of well-known cloud networks is shown next to internet addresses. Admins can give an address a name.

Traffic by site

Set Show to Sites for one row per site: internet down and up, traffic from and to other sites (including the data center), and traffic between the site's own networks, with its busiest hosts. Select a site to see its chart, hosts, applications and conversations. Addresses are given to sites from the devices you monitor: a network goes to the site most of its devices belong to. Users limited to some sites only ever see those sites' traffic.

Tip: One central router only sees traffic that passes through it. If branches have their own internet connection, or you also want traffic between a branch's own networks, export flows from the branch routers too.

Several routers

Point as many routers and firewalls at the collector as you like. Pick one in Exporter to see what it saw, or All exporters for the whole network: a conversation reported by two routers on its way (a branch router and the head-office router, say) is counted once. Interfaces are shown by their real names and descriptions, read over SNMP from each router Monitaria monitors.

Charts

• Traffic over time: Total, or stacked by Applications or Application groups, to see what fills the pipe hour by hour.
• Links: every interface with average, peak and the 95th percentile against its speed, the usual number for deciding whether a circuit needs upgrading. Links busy 80% of the time or more appear in the health review.
• Busy hours: average traffic for each hour of the week over the last four weeks. The lightest hours are the best maintenance windows.
• Sites: a flow diagram from each site to the internet, other sites and its own networks.

Application groups

Traffic is also grouped by what it is: Teams & Microsoft 365, video meetings, Windows Update, remote access, file sharing, storage, phones, Google, Apple, content networks and web. Add your own under More settings in Settings › NetFlow, one per line, for example Hosted EHR: net 10.236.0.0/16, or Backups: tcp/10000, owner Amazon AWS. Your groups are matched before the built-in ones.

Unusual traffic

Every five minutes the collector compares each internal host with its own normal: a host that suddenly uploads far more to the internet than usual (cloud sync, an unknown backup, or data leaving the network), or one that opens file-sharing or remote-access connections to many internal hosts at once, which is how ransomware spreads. Findings appear at the top of the Traffic tab; Alert me about unusual traffic adds a sensor that alerts through your alert rules. Ignore backup, patching and management servers that do this on purpose. The first week is used to learn what is normal.

Calls and video

In the Sites view, Calls and video shows each site's Teams, Zoom, Webex and phone media, how much of it carries a priority mark (DSCP EF or AF41), and the site router's ping jitter. Unmarked calls on a busy link are the usual cause of choppy audio; the risk column combines the two.

Alerts on traffic

From the Traffic tab, admins can add an alert on the total traffic through an exporter or on one host's traffic, in Mbit/s averaged over five minutes. It becomes a NetFlow sensor in Devices › Sensors, with the same alert rules and maintenance windows as any other check. A NetFlow sensor also goes down when its exporter stops sending flows, so a broken export doesn't go unnoticed.

Privacy and storage

Flow data stays on the collector and is never sent to the hub. It is kept in 5-minute detail for 3 days and as hourly totals for 30 days by default (up to 90). Each bucket keeps its largest conversations, hosts and applications and adds the rest up as Everything else, so storage stays small however busy the network is.