Network traffic

    NetFlow analysis: know what is happening on your network

    FlowPro NG collects flows from routers, firewalls and switches and shows who talks to whom, how much data moves and where to. No probes, no port mirroring, on your own server.
    Try it free for 14 daysOnline demo
    flowpro.local/flowpro
    Flow Collector in FlowPro NG

    Logs tell you what happened on a device. Flows tell you what happened on the network.

    A device that cannot run an agent (printer, camera, PLC, IoT) never shows up in your logs, but the router still sees its traffic. When an infected workstation starts talking to an unknown server abroad or someone copies data out, flows show it before any log does.

    Almost every router and firewall you already own can export NetFlow. Turn the export on, point it at FlowPro NG and you are done: no extra hardware, no changes to the network topology.

    What you get

    NetFlow analysis in FlowPro NG

    NetFlow v5/v9, IPFIX and sFlow

    The collector accepts flows from Cisco, MikroTik, Fortinet, Juniper, Ubiquiti and Linux (softflowd). Data streams through Kafka into ClickHouse, so a query over millions of flows takes a fraction of a second.

    Top talkers and conversations

    Which device sends the most data, where and over which protocol. Rankings of source and destination IPs, ports and communicating pairs for any time range.

    GeoIP map and ASN

    Every flow is enriched with country, city, ASN and provider. The map shows straight away traffic to countries you normally never talk to.

    17 anomaly detections

    Every minute FlowPro NG checks for port scans, SYN/UDP/ICMP floods, DNS and NTP amplification, brute force, beaconing, lateral movement, DNS and ICMP tunnels, crypto mining and data exfiltration.

    Individual flow browser

    When you need the detail, find a specific connection by IP, port, protocol or time and export it as evidence for an incident.

    Anomalies with adjustable thresholds

    Detected anomalies appear on the main Dashboard and in the Anomalies tab with severity, source and destination. Thresholds, severity and exceptions are set per detection.

    • NetFlow v5
    • NetFlow v9
    • IPFIX
    • sFlow
    • Cisco
    • MikroTik
    • Fortinet
    • Juniper
    • Ubiquiti
    • softflowd
    • ClickHouse
    • GeoIP

    How it works

    Up and running in a few steps

    1. 01

      Install FlowPro NG

      On an Ubuntu 24.04 server with one command from the APT repository. The flow collector is part of every license, the free one included.

    2. 02

      Turn on flow export

      On the router or firewall, point the NetFlow/IPFIX/sFlow export at the FlowPro NG address (UDP port 12051). The documentation covers MikroTik and Linux.

    3. 03

      See data within a minute

      The source appears on its own. Anomaly detection runs from the start with default thresholds that you tune to your network later.

    FAQ

    Frequently asked questions

    What is the difference between NetFlow and port mirroring?

    Mirroring (SPAN) sends a copy of every packet and needs a powerful probe. NetFlow sends only a summary of each connection (who, where, how much, when), so it puts far less load on the network and the server and works on links you cannot mirror. Packet content is analyzed by the IDS, which FlowPro NG also includes.

    Which devices can export NetFlow?

    Most business routers and firewalls: Cisco, MikroTik (Traffic Flow), Fortinet, Juniper (J-Flow), Ubiquiti, Huawei and others. On Linux, softflowd does the job. FlowPro NG accepts NetFlow v5 and v9, IPFIX and sFlow.

    Is the NetFlow analysis free?

    Yes. The flow collector is included in the free version of FlowPro NG for one flow source and 30 days of history. Paid licenses add more sources and longer data retention.

    How much data and what server do I need?

    Flows are small and ClickHouse compresses them heavily. A server with 16–32 GB of RAM is enough for a small or mid-sized network. The Sizing chapter in the documentation calculates it from your flows per second.

    Does any data leave my network?

    No. FlowPro NG runs on your server and stores flows locally. Only the license check and technical instance status (version, number of sources) leave the network, never traffic data.

    Related solutions

    Network anomaly detection17 detections over network flows every minute: port scans, floods, data exfiltration, beaconing, lateral movement, tunnels.Intrusion detection (IDS)Suricata IDS inspects network traffic packet by packet and alerts you to intrusion attempts, malware and exploits. DNS, HTTP, TLS and FTP included.ISP data retentionFor Czech internet providers: flows from your routers, IP-to-subscriber mapping and data export in the format of Czech Decree No. 357/2012 Coll.
    How FlowPro NG compares to Wazuh, Elastic, Splunk and Flowmon

    Try it on your own network

    The 14-day Enterprise trial unlocks every module. You install it on your own server, no credit card needed.

    Start Free TrialOnline Demo