NetFlow, sFlow & IPFIX Collector and Analyzer
Know who talks to whom without capturing every packet
Routers, switches and firewalls export NetFlow, IPFIX or sFlow. A collector receives the exports and an analyzer turns them into dashboards, alerts and history.
ntop provides both parts: nProbe collects and generates flows, and ntopng analyzes them.
NetFlow
and sFlow
with nProbe Cento
Formats
NetFlow, IPFIX and sFlow in short
- NetFlow v5 and v9: flow records exported by network devices.
- IPFIX: the IETF standard based on NetFlow v9, with flexible templates.
- sFlow: sampled packets and interface counters exported by switches and routers.
Read how sampling and throughput calculation work before you compare numbers across tools.
Reference architecture
- Routers, switches and firewalls export flows to nProbe in collector mode.
- nProbe enriches the flows and sends them to ntopng over ZeroMQ.
- ntopng shows live and historical traffic, raises alerts and can store flows in ClickHouse.
- Where devices cannot export flows, nProbe or nProbe Cento generates them from a mirror port or TAP.
Step by step: how to configure flow collection in nProbe and ntopng and the NetFlow and sFlow monitoring use case.
Compare
NetFlow, IPFIX and sFlow side by side
| NetFlow v5 and v9 | IPFIX | sFlow | |
|---|---|---|---|
| What it exports | Flow records | Flow records with flexible templates | Sampled packets and interface counters |
| Standard | Cisco originated | IETF standard | Industry standard |
| Typical devices | Routers and firewalls | Routers, firewalls, probes | Switches and routers |
| Sampling | Optional | Optional | Always sampled |
Free and open source
Is there a free NetFlow analyzer or collector?
Free and open source with ntopng
ntopng Community is free and open source and analyzes traffic from packets and from flows. To collect NetFlow, IPFIX and sFlow from routers, ntopng uses nProbe as the collector. nProbe is a commercial product (Pro from 299.95€), see pricing.
Open source NetFlow monitoring with Grafana and ClickHouse
ntopng can store flows in ClickHouse for history, and you can build Grafana dashboards on top. Read ntopng dashboards with Grafana and ClickHouse.
NetFlow analyzer for MikroTik, pfSense and OPNsense
NetFlow collector for a high-speed link
For 10 to 100 Gbit use nProbe Cento with ntopng.
Start now
Step by step
Products
Which product do I need?
nProbe and ntopng
Collect flows from many devices.
nProbe Cento
Generate flows from 10, 40 and 100 Gbit links.
nBox NetFlow
A turnkey box.
FAQ
Frequently Asked Questions
What is the difference between NetFlow, sFlow and IPFIX?
NetFlow (v5, v9) is a Cisco-originated flow export format and IPFIX is its IETF standard evolution. sFlow samples packets and counters from switches and routers. All three describe who talked to whom, but flow formats aggregate traffic while sFlow relies on sampling.
Do I need a probe if my routers already export NetFlow?
Not for traffic your routers already see. You need a collector such as nProbe to receive the flows and deliver them to ntopng. Use a probe when you want visibility from a mirror port or TAP, or to add Layer-7 detail that routers cannot provide.
Can ntopng store flows for later investigation?
Yes. ntopng can dump flows to ClickHouse for historical analysis. See the ClickHouse guide.
Is there a free NetFlow analyzer?
ntopng Community is free and open source. To receive NetFlow, IPFIX and sFlow from routers it uses nProbe, which is a commercial product starting at 299.95 euro.
What is the best open source NetFlow collector?
ntopng with nProbe is a complete open source based option: nProbe collects and normalizes the flows and ntopng shows them with Layer-7 detail, alerts and history.
How does sampling affect the numbers?
With sampled exports, counters are estimates scaled by the sampling rate. See our article on how sampling and throughput calculation work for NetFlow, IPFIX and sFlow.
Get started
Start collecting flows today
Download the free Community edition, compare editions and buy in the shop, or talk to the ntop team about your requirements.
