Export flows to a collector#

You will end up with the router exporting a record of every flow to a collector, so somebody else keeps the history. This is the answer to "what was using the link last Tuesday", because the router itself will never be able to answer it.

Before you start#

The operator role and a licence.
A collector's address and port. 2055 is the convention and the router's default.
Which interfaces to watch. Usually the uplink; watching the LAN as well doubles the records for the same traffic.

Step 1 — Configure the export#

Services → Sessions → Flow export.

set system flow-accounting netflow interface eth1
set system flow-accounting netflow server 192.0.2.70
set system flow-accounting netflow server 192.0.2.70 port 2055
set system flow-accounting netflow version 9
set system flow-accounting netflow sampling-rate 100

Field	Command	Notes
Interfaces	`interface <if>`, one line each	The panel takes them as checkboxes
Collector	`server <addr>`
Port	`server <addr> port <n>`	Defaults to 2055
Version	`version 9` or `version 10`	9 is NetFlow, 10 is IPFIX. 9 is the default and is not written.
Sampling	`sampling-rate <n>`	1 in `n` packets. Unset means every packet.

The panel's summary reads back what is configured: what it is watching, the collectors with their ports, whether the format is IPFIX or NetFlow v9, and whether sampling is on — shown as 1 in n packets or every packet.

Step 2 — Decide about sampling#

Every packet is accurate and expensive. Sampling is cheap and statistical.

On a busy uplink on a small box, flow accounting is real CPU work — and there are no throughput figures in this project, because none has been measured. Start with a sampling rate, watch the load, and lower it only if the collector's picture is too coarse.

Step 3 — Commit and confirm the collector sees records#

Check it worked#

On the collector, flow records from the router's address should appear within a minute.

On the router:

bash

show flow-accounting interface eth1

And confirm the load is acceptable — Diagnostics → Health shows per-CPU connection-tracking pressure, and the dashboard shows load.

What this gets you that the router cannot#

ntopng is in the app catalogue if you would rather run the collector on the router itself, which is a reasonable choice on a box with the memory for it — Install an app.

Conntrack byte counters#

Platform gap

Byte counters on conntrack flows require nf_conntrack_acct to be enabled in the kernel. Without it, the Sessions page has flows with no byte counts, and the top-talker aggregation has less to work with. It is a kernel tunable:

set system sysctl parameter net.netfilter.nf_conntrack_acct value 1

It costs a little memory and a little CPU per connection. Flow export is unaffected either way — it counts separately.

Undoing it#

delete system flow-accounting

The panel's Stop exporting stages exactly that.