Network security

    Network anomaly detection: spot suspicious traffic within a minute

    Every minute FlowPro NG checks network flows from all sources for 17 kinds of suspicious behavior: scans, floods, data exfiltration, command-and-control traffic and an attacker moving inside the network. No agents, no traffic mirroring.
    Try it free for 14 daysOnline demo
    flowpro.local/flowpro
    Flow Collector with anomaly detection in FlowPro NG

    An attack on the network may leave no log. It always leaves a trace in the traffic.

    An infected camera that calls the same server every few minutes. A workstation trying SMB and RDP on dozens of internal addresses at night. A server sending gigabytes of data out. None of it shows up in application logs, but it is plain to see in the flows.

    You will not find anything by hand in millions of flows. Anomaly detection goes through them for you, compares them with the configured thresholds and shows only what deserves attention, with a severity level.

    What you get

    Network anomaly detection in FlowPro NG

    Scans and reconnaissance

    Horizontal and vertical port scans and bursts of failed connections (TCP RST). Catches both an outside attacker and an infected workstation mapping the internal network.

    Floods and amplification attacks

    SYN, UDP and ICMP floods, DNS amplification and amplification via NTP, SSDP and Memcached. You see who is targeted and where the traffic comes from.

    Exfiltration and covert channels

    Unusually large outbound volume from a single address, DNS tunnels (many DNS flows with large packets) and ICMP tunnels (pings with unusually large payloads).

    Attacker inside the network

    Beaconing (connections at regular intervals with constant size, typical of malware command-and-control), lateral movement over SMB, RDP, SSH and WinRM, brute force against SSH, RDP, FTP and Telnet.

    Crypto mining, risky countries, after hours

    Traffic on typical mining pool ports, traffic to risky countries by GeoIP and unusual activity outside working hours (22:00–06:00).

    Thresholds, severity and whitelist

    Turn each detection on or off and set its threshold and the limits for medium, high and critical severity. Add a backup server or monitoring probe to the whitelist so it does not cause false positives.

    • NetFlow v5
    • NetFlow v9
    • IPFIX
    • sFlow
    • ClickHouse
    • GeoIP
    • DDoS
    • SMB
    • RDP
    • SSH
    • WinRM
    • DNS
    • NTP
    • ICMP

    How it works

    Up and running in a few steps

    1. 01

      Install FlowPro NG

      On an Ubuntu 24.04 server with one command from the APT repository. The flow collector and anomaly detection are part of every license, the free one included.

    2. 02

      Send flows from your router

      On the router or firewall, turn on NetFlow, IPFIX or sFlow export to the FlowPro NG address (UDP port 12051).

    3. 03

      Detections run every minute

      All 17 detections start with default thresholds. Findings appear on the Dashboard and in the Anomalies tab of the Flow Collector, including a map of sources and destinations.

    4. 04

      Tune it to your network

      In the Detection tab, adjust thresholds and severities and fill in the whitelist. Every network is different, and a few changes in the first days cut false positives significantly.

    FAQ

    Frequently asked questions

    What is network anomaly detection?

    It analyzes network traffic for behavior that differs from the norm: unusual volume, number of connections, ports or destinations. In FlowPro NG it works on connection summaries (NetFlow, IPFIX, sFlow), not packet content, so an export from your router is all it needs.

    What is the difference between anomaly detection and IDS?

    An IDS (Suricata in FlowPro NG) inspects packet content for known attack signatures and needs mirrored traffic. Anomaly detection watches flow behavior, works on links you cannot mirror and also catches attacks with no known signature. They work best together.

    Can FlowPro NG detect a DDoS attack?

    Yes, it detects SYN, UDP and ICMP floods and amplification attacks via DNS, NTP, SSDP and Memcached. FlowPro NG detects the attack and shows the sources and target, but it does not block traffic itself. Blocking is done on your firewall or by your internet provider.

    How do I reduce false positives?

    Every detection has an adjustable threshold and severity limits and can be turned off. Devices that legitimately behave unusually, such as a backup server or vulnerability scanner, go on the whitelist. Changes apply at the next one-minute evaluation.

    Is anomaly detection free?

    Yes. All 17 detections are part of the Flow Collector in the free version of FlowPro NG for one flow source. Data stays on your server, only the license check and technical instance status leave it.

    Related solutions

    NetFlow analysisWho talks to whom on your network, how much and where. NetFlow, IPFIX and sFlow from routers and firewalls, no traffic mirroring.Intrusion detection (IDS)Suricata IDS inspects network traffic packet by packet and alerts you to intrusion attempts, malware and exploits. DNS, HTTP, TLS and FTP included.HoneypotA decoy that draws attackers in. See who attacks, which passwords they try and which commands they run, before they reach your real servers.
    How FlowPro NG compares to Wazuh, Elastic, Splunk and Flowmon

    Try it on your own network

    The 14-day Enterprise trial unlocks every module. You install it on your own server, no credit card needed.

    Start Free TrialOnline Demo