MetricSplit › NetFlow collector
NetFlow collector and network traffic analysis
A NetFlow collector receives the flow records your routers and firewalls export: who talked to which service, how much, through which interface. MetricSplit is a hosted collector and analyzer built on the NetFlow v9 and IPFIX standards. You point the export at it; it turns the records into a per-circuit answer: how full each WAN circuit runs, what fills it, and what to do about it.
What the collector does with your flow records
- Reads NetFlow v9 and IPFIX templates, including application IDs and interface names when the device sends them, and keeps the templates it has learned across its own restarts.
- Works out direction from the interfaces, so download and upload are measured separately on each WAN circuit.
- Classifies the traffic as business, neutral (updates, backups, sign-in) or non-business, by application and by site.
- Measures each circuit in 5-minute readings and judges it on its busiest business-hours moments (the 95th percentile over 7 days), per direction.
- Gives each circuit a decision: rebalance, right-size, restrict or upgrade, with the evidence.
Network traffic analysis without the packet contents
Flow records are metadata: addresses, ports, protocol, byte and packet counts, times, interfaces and, when available, the application. No packet contents. That is enough to see which applications and hosts fill each circuit, and it never puts anything in your traffic path.
Which devices can send to it
Supported today: Cisco Catalyst SD-WAN (IPFIX through cflowd). Fortinet, Palo Alto, Juniper, Meraki and MikroTik are rolling out. Each has a setup guide covering the collector address and port, NAT, templates, sampling and application ID.
Questions about NetFlow collectors
What is the difference between a NetFlow collector and a NetFlow analyzer?
The collector receives and stores the flow records; the analyzer turns them into reports. MetricSplit does both: you send the export, and you see each circuit's traffic, classification and decision.
Which port does a NetFlow collector use?
Flow records travel over UDP to one address and port. Port 2055 is the usual NetFlow port and 4739 is IPFIX's registered port; use the one your collector listens on.
NetFlow v9 or IPFIX: which should I use?
IPFIX where the device offers it, otherwise NetFlow v9. NetFlow v5 has a fixed, short list of fields and no room for application names.
Does the collector need every packet?
No. Devices that sample 1 packet in N can work, as long as the collector knows the rate to scale the counts back up. Unsampled exports avoid the question.
Send your flow data, get a decision per circuit
Metadata only, never in your traffic path. A full security pack is available on request.