Export flows to a collector#

You will end up with the router sending a record of its traffic flows to a collector, which keeps them for as long as you choose and breaks them down by host, port and protocol.

Before you start#

The operator role and a licence.
The collector's IP address, and its port if it is not 2055, the router's default.
Which interfaces to report. Usually the uplink, which carries all the traffic to and from the internet.

Step 1 — Set up the export#

Open Observe → Sessions. Flow export is the last panel.
Press Set up flow export. The Set up flow export side panel opens.
Under Interfaces, tick the interfaces whose traffic is reported.
Under Collectors, press Add collector and enter its Address, and its Port if it is not 2055. Add more collectors the same way; Remove takes one out.
Under Records, choose the Format: NetFlow v9, IPFIX or NetFlow v5. A new export starts on NetFlow v9.
Leave Sampling rate empty, or enter one (step 2).
Switch on Include outgoing traffic to report traffic leaving the interfaces as well. Off, only traffic arriving on them is reported.
Press Turn on flow export, then Apply changes in the bar at the bottom of the page.

The side panel checks the form before anything is added, and shows the first problem at its foot: "Choose at least one interface.", "Add a collector.", "Enter a port from 1 to 65535.", "Enter a whole number of packets." The pending change reads Turn on flow export, with the collectors, interfaces and format under it. Advanced mode also shows the commands it makes.

Step 2 — Decide about sampling#

With Sampling rate empty, every packet is counted: exact figures, and the most processing on the router. A sampling rate of N counts one packet in N: less processing, and figures the collector has to estimate from the sample.

To choose, start with a sampling rate, watch the Load meter at the top of the Overview, and enter a smaller number if the collector needs more detail.

Check it worked#

On the collector, records from the router's address should start to arrive.

On the router, the Flow export panel shows the settings in force: Interfaces, Collectors with their ports, Format, Sampling and Traffic. The UI does not show whether records are being sent; the collector is where to check.

What the router keeps, and what a collector adds#

ntopng, in the app catalogue, records and charts each device's traffic on the router itself, from the packets on an interface. It needs memory on the router: Install an app.

Undoing it#

Press Turn off in the Flow export panel, and press it again when it asks Turn off flow export?. Then press Apply changes. Turning it off removes all the flow export settings.

To change the export instead, press Edit, change the side panel, and press Save changes.