Documentation
VyOS Documentation
VyOS System Configuration
Flow Accounting - Network Flow Monitoring

Flow Accounting - Network Flow Monitoring

Flow Accounting - Network Flow Monitoring

Introduction

Flow Accounting is a mechanism for monitoring and analyzing network traffic that collects statistics about data flows passing through a router. VyOS supports several flow export protocols: NetFlow (versions 5, 9, and 10), IPFIX, and sFlow.

Core Components

Flow Accounting consists of three main components:

  1. Exporter - the VyOS router that collects packet information and aggregates it into flows
  2. Collector - the server that receives and stores flow data
  3. Application - software for analyzing and visualizing flow data

Supported Protocols

  • NetFlow v5 - the classic version, supports IPv4 only
  • NetFlow v9 - an extended version with template support and IPv6
  • NetFlow v10 (IPFIX) - the standardized version of NetFlow, RFC 7011
  • sFlow - a packet sampling technology (not covered in this document)

Basic Configuration

Enabling Flow Accounting on Interfaces

Flow Accounting must be explicitly enabled on every interface where traffic monitoring is required:

set system flow-accounting interface eth0
set system flow-accounting interface eth1
set system flow-accounting interface eth2

Configuring a NetFlow Collector

The minimal configuration for exporting flows to a collector:

# Configure the collector
set system flow-accounting netflow server 192.168.100.50 port 2055

# Select the NetFlow version
set system flow-accounting netflow version 9

# Specify the source address for NetFlow packets
set system flow-accounting netflow source-address 192.168.0.1

NetFlow Version 5

NetFlow v5 is the most widely supported version, but it is limited to IPv4 traffic only.

Complete NetFlow v5 Configuration

# Enable interfaces
set system flow-accounting interface eth0
set system flow-accounting interface eth1

# Configure NetFlow v5
set system flow-accounting netflow version 5
set system flow-accounting netflow server 192.168.100.50 port 2055
set system flow-accounting netflow source-address 192.168.0.1

# Configure the Engine ID (router identifier)
set system flow-accounting netflow engine-id 1

# Configure timeouts
set system flow-accounting netflow timeout expiry-interval 60
set system flow-accounting netflow timeout flow-generic 3600
set system flow-accounting netflow timeout tcp-generic 3600
set system flow-accounting netflow timeout tcp-fin 300
set system flow-accounting netflow timeout tcp-rst 120
set system flow-accounting netflow timeout udp 300

# Limit the maximum number of tracked flows
set system flow-accounting netflow max-flows 10000

# Apply the configuration
commit
save

NetFlow v5 Parameters

  • engine-id - a unique router identifier (0-255)
  • timeout expiry-interval - the flow export interval in seconds (0-2147483647)
  • timeout flow-generic - timeout for generic flows in seconds
  • timeout tcp-generic - timeout for TCP connections
  • timeout tcp-fin - timeout for TCP connections with the FIN flag
  • timeout tcp-rst - timeout for TCP connections with the RST flag
  • timeout udp - timeout for UDP flows
  • max-flows - the maximum number of simultaneously tracked flows

NetFlow Version 9

NetFlow v9 supports templates, IPv6, and extended metadata.

NetFlow v9 Configuration

# Enable interfaces
set system flow-accounting interface eth0
set system flow-accounting interface eth1
set system flow-accounting interface eth2

# Configure NetFlow v9
set system flow-accounting netflow version 9
set system flow-accounting netflow server 192.168.100.50 port 2055
set system flow-accounting netflow source-address 192.168.0.1

# Configure the template refresh rate
set system flow-accounting netflow timeout template 60

# Configure timeouts
set system flow-accounting netflow timeout expiry-interval 60
set system flow-accounting netflow timeout flow-generic 3600

# Apply the configuration
commit
save

Additional NetFlow v9 Parameters

  • timeout template - the template transmission interval in seconds (1-86400)

IPFIX (NetFlow v10)

IPFIX is the standardized version of NetFlow defined in RFC 7011. It is the recommended version for new deployments.

IPFIX Configuration

# Enable interfaces
set system flow-accounting interface eth0
set system flow-accounting interface eth1

# Configure IPFIX (NetFlow v10)
set system flow-accounting netflow version 10
set system flow-accounting netflow server 192.168.100.50 port 4739
set system flow-accounting netflow source-address 192.168.0.1

# Configure timeouts
set system flow-accounting netflow timeout expiry-interval 60
set system flow-accounting netflow timeout flow-generic 3600
set system flow-accounting netflow timeout tcp-generic 3600
set system flow-accounting netflow timeout tcp-fin 300
set system flow-accounting netflow timeout tcp-rst 120
set system flow-accounting netflow timeout udp 300

# Apply the configuration
commit
save

Standard Ports

  • NetFlow v5/v9: port 2055 (UDP) is commonly used
  • IPFIX: the standard port is 4739 (UDP)

Sampling Rate

Sampling reduces the load on the router by analyzing only every Nth packet.

Configuring Sampling

# Analyze every 100th packet
set system flow-accounting netflow sampling-rate 100

# Analyze every 1000th packet (for high-load networks)
set system flow-accounting netflow sampling-rate 1000

# Analyze every 10th packet (for small networks)
set system flow-accounting netflow sampling-rate 10

Sampling Recommendations

Network loadRecommended sampling-rateAccuracy
< 100 Mbps10-50High
100-500 Mbps100-200Medium
500 Mbps - 1 Gbps500-1000Basic
> 1 Gbps1000-5000Overview

Important: Without sampling (sampling-rate 1) every packet is analyzed, which can lead to high CPU load under heavy traffic volumes.

Configuring Multiple Collectors

VyOS supports exporting flows to multiple collectors simultaneously to ensure fault tolerance.

Configuration with Multiple Collectors

# Primary collector
set system flow-accounting netflow server 192.168.100.50 port 2055

# Backup collector
set system flow-accounting netflow server 192.168.100.51 port 2055

# Collector in another data center
set system flow-accounting netflow server 10.200.50.10 port 2055

commit
save

Aggregation

Aggregation lets you combine flows by specific criteria to reduce the volume of exported data.

Configuring Aggregation

# Aggregate by source AS (Autonomous System)
set system flow-accounting netflow aggregation source-as

# Aggregate by destination AS
set system flow-accounting netflow aggregation destination-as

# Aggregate by source prefixes
set system flow-accounting netflow aggregation source-prefix

# Aggregate by destination prefixes
set system flow-accounting netflow aggregation destination-prefix

# Aggregate by protocol ports
set system flow-accounting netflow aggregation protocol-port

commit
save

Aggregation Types

  • source-as - grouping by source autonomous system
  • destination-as - grouping by destination autonomous system
  • source-prefix - grouping by source prefix
  • destination-prefix - grouping by destination prefix
  • protocol-port - grouping by protocol and port

In-Memory Flow Table (not recommended for production)

VyOS can store flows in an in-memory table for local viewing.

Configuring the Local Table

# WARNING: Not recommended for production!
set system flow-accounting buffer-size 10485760  # 10 MB

commit
save

Warning: Using a local flow table can lead to:

  • Increased CPU load
  • Unstable router operation
  • Memory exhaustion under heavy load

We recommend using external collectors instead of a local table.

Example for Yandex Cloud

Exporting NetFlow to the Yandex Cloud Monitoring System

# VyOS configuration in Yandex Cloud
configure

# Enable Flow Accounting on the external and internal interfaces
set system flow-accounting interface eth0  # External interface
set system flow-accounting interface eth1  # Internal interface (subnets in the VPC)

# Configure IPFIX for export to a collector in Yandex Cloud
set system flow-accounting netflow version 10
set system flow-accounting netflow server 10.128.0.50 port 4739
set system flow-accounting netflow source-address 10.128.0.1

# Sampling to optimize load
set system flow-accounting netflow sampling-rate 200

# Configure timeouts
set system flow-accounting netflow timeout expiry-interval 60
set system flow-accounting netflow timeout flow-generic 3600
set system flow-accounting netflow timeout tcp-generic 3600
set system flow-accounting netflow timeout tcp-fin 300
set system flow-accounting netflow timeout tcp-rst 120
set system flow-accounting netflow timeout udp 300

# Limit the number of flows
set system flow-accounting netflow max-flows 50000

# Backup collector in another availability zone
set system flow-accounting netflow server 10.129.0.50 port 4739

commit
save
exit

Integration with Yandex Monitoring

The following collectors can be used for integration with Yandex Monitoring:

  • ntopng - deployed on a VM in Yandex Compute Cloud
  • ElastiFlow - based on Elasticsearch in Yandex Managed Service for Elasticsearch
  • Grafana + ClickHouse - for long-term storage and analysis

Example of installing ntopng on Ubuntu in Yandex Cloud:

# On the collector in Yandex Cloud
sudo apt-get update
sudo apt-get install software-properties-common wget
sudo add-apt-repository universe

wget https://packages.ntop.org/apt/ntop.key
sudo apt-key add ntop.key

echo "deb https://packages.ntop.org/apt/stable/ $(lsb_release -cs) main" | \
  sudo tee /etc/apt/sources.list.d/ntop-stable.list

sudo apt-get update
sudo apt-get install ntopng nprobe

# Configure nProbe to receive NetFlow/IPFIX
sudo nano /etc/nprobe/nprobe.conf

nProbe configuration:

--zmq=tcp://127.0.0.1:5556
--collector-port=4739
--collector-protocol=ipfix
-i=none

ntopng configuration:

--zmq=tcp://127.0.0.1:5556
-i=tcp://127.0.0.1:5556

Example for VK Cloud

IPFIX for Traffic Analysis in VK Cloud

# VyOS configuration in VK Cloud
configure

# Enable Flow Accounting on all active interfaces
set system flow-accounting interface eth0  # External interface (ext-net)
set system flow-accounting interface eth1  # Internal interface (private network)
set system flow-accounting interface eth2  # DMZ interface

# Configure IPFIX
set system flow-accounting netflow version 10
set system flow-accounting netflow server 10.0.10.100 port 4739
set system flow-accounting netflow source-address 10.0.10.1

# Moderate sampling to balance accuracy and performance
set system flow-accounting netflow sampling-rate 100

# Configure the Engine ID (unique router ID)
set system flow-accounting netflow engine-id 10

# Timeouts for different flow types
set system flow-accounting netflow timeout expiry-interval 60
set system flow-accounting netflow timeout flow-generic 3600
set system flow-accounting netflow timeout tcp-generic 3600
set system flow-accounting netflow timeout tcp-fin 300
set system flow-accounting netflow timeout tcp-rst 120
set system flow-accounting netflow timeout udp 300
set system flow-accounting netflow timeout icmp 300

# Maximum number of tracked flows
set system flow-accounting netflow max-flows 100000

# Aggregation by protocol and port to simplify analysis
set system flow-accounting netflow aggregation protocol-port

# Backup collector
set system flow-accounting netflow server 10.0.20.100 port 4739

commit
save
exit

Using ElastiFlow in VK Cloud

ElastiFlow is a popular solution for analyzing NetFlow/IPFIX based on the Elastic Stack.

Installing ElastiFlow on a VM in VK Cloud:

# Install Docker
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh

# Create docker-compose.yml for ElastiFlow
mkdir elastiflow && cd elastiflow
nano docker-compose.yml

Example docker-compose.yml:

version: '3'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.17.0
    container_name: elasticsearch
    environment:
      - discovery.type=single-node
      - "ES_JAVA_OPTS=-Xms2g -Xmx2g"
    ports:
      - "9200:9200"
    volumes:
      - esdata:/usr/share/elasticsearch/data

  kibana:
    image: docker.elastic.co/kibana/kibana:7.17.0
    container_name: kibana
    ports:
      - "5601:5601"
    environment:
      ELASTICSEARCH_HOSTS: http://elasticsearch:9200

  elastiflow:
    image: robcowart/elastiflow-logstash-oss:4.0.1
    container_name: elastiflow
    network_mode: host
    environment:
      - ELASTIFLOW_ES_HOST=127.0.0.1:9200
      - ELASTIFLOW_NETFLOW_IPV4_PORT=2055
      - ELASTIFLOW_SFLOW_IPV4_PORT=6343
      - ELASTIFLOW_IPFIX_TCP_IPV4_PORT=4739

volumes:
  esdata:

Starting ElastiFlow:

sudo docker-compose up -d

After startup, Kibana will be available at: http://<VM_IP>:5601

Multi-Interface Configuration

Selective Interface Monitoring

configure

# Monitor only external interfaces
set system flow-accounting interface eth0  # WAN1
set system flow-accounting interface eth1  # WAN2

# Exclude internal interfaces to reduce load
# set system flow-accounting interface eth2  # LAN - not monitored

# Configure NetFlow v9
set system flow-accounting netflow version 9
set system flow-accounting netflow server 192.168.100.50 port 2055
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 500

commit
save
exit

Advanced Configuration with Filtering

Configuration for Monitoring Only Critical Flows

configure

# Enable on all interfaces
set system flow-accounting interface eth0
set system flow-accounting interface eth1
set system flow-accounting interface eth2

# Configure IPFIX with aggressive sampling
set system flow-accounting netflow version 10
set system flow-accounting netflow server 192.168.100.50 port 4739
set system flow-accounting netflow server 192.168.100.51 port 4739  # Backup
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 1000  # Every 1000th packet

# Short timeouts for fast updates
set system flow-accounting netflow timeout expiry-interval 30
set system flow-accounting netflow timeout flow-generic 1800
set system flow-accounting netflow timeout tcp-generic 1800
set system flow-accounting netflow timeout tcp-fin 120
set system flow-accounting netflow timeout tcp-rst 60
set system flow-accounting netflow timeout udp 120
set system flow-accounting netflow timeout icmp 120

# Large flow count for high-load networks
set system flow-accounting netflow max-flows 500000

# Aggregation to reduce data volume
set system flow-accounting netflow aggregation protocol-port
set system flow-accounting netflow aggregation destination-prefix

commit
save
exit

Verifying the Configuration

Viewing the Current Configuration

# Show the entire Flow Accounting configuration
show configuration system flow-accounting

# Show only the NetFlow settings
show configuration system flow-accounting netflow

Example output:

flow-accounting {
    interface eth0
    interface eth1
    netflow {
        engine-id 1
        max-flows 10000
        sampling-rate 100
        server 192.168.100.50 {
            port 2055
        }
        source-address 192.168.0.1
        timeout {
            expiry-interval 60
            flow-generic 3600
            tcp-fin 300
            tcp-generic 3600
            tcp-rst 120
            udp 300
        }
        version 9
    }
}

Operational Commands

Viewing Flow Statistics

# Show flows on the eth0 interface
show flow-accounting interface eth0

# Show flows on the eth1 interface
show flow-accounting interface eth1

# Show flows for a specific host
show flow-accounting interface eth0 host 192.168.1.100

# Show the top 20 flows by traffic volume
show flow-accounting interface eth0 | head -20

Example output of show flow-accounting interface eth0:

flow-accounting for interface eth0

Src IP Addr:Port    Dst IP Addr:Port    Proto    Packets    Bytes
192.168.1.10:443    8.8.8.8:53         UDP      1234       567890
192.168.1.20:80     1.1.1.1:443        TCP      5678       2345678
192.168.1.30:22     10.0.0.50:54321    TCP      910        123456

Filtering the Output

# Show only TCP flows
show flow-accounting interface eth0 | grep TCP

# Show only flows from a specific subnet
show flow-accounting interface eth0 | grep "192.168.1."

# Show flows to port 443 (HTTPS)
show flow-accounting interface eth0 | grep ":443"

# Show the top 10 flows sorted by bytes
show flow-accounting interface eth0 | sort -k5 -n -r | head -10

Monitoring NetFlow Export

Verifying That NetFlow Packets Are Sent

# Check active connections to the collector (on VyOS)
sudo netstat -anu | grep 2055

# Check using tcpdump
sudo tcpdump -i any port 2055 -n

# Check UDP traffic to the collector
sudo tcpdump -i any host 192.168.100.50 and port 2055 -vv

Verifying on the Collector Side

# On the collector: listen for NetFlow packets
sudo tcpdump -i eth0 port 2055 -n -vv

# Check that the port is open on the collector
sudo netstat -anu | grep 2055
sudo ss -anu | grep 2055

Troubleshooting

Enabling Debug Mode

# Check the system logs
show log | grep flow

# Monitor system resources
show system resource

# Check CPU load
top

Checking Collector Reachability

# Ping the collector
ping 192.168.100.50

# Check the route
traceroute 192.168.100.50

# Check UDP connectivity (requires nc/netcat)
nc -u 192.168.100.50 2055

Common Problems and Solutions

1. NetFlow Packets Do Not Reach the Collector

Symptoms:

  • The collector receives no data
  • tcpdump on VyOS shows outgoing packets, but the collector does not see them

Solutions:

# Verify that the source-address is correct
show configuration system flow-accounting netflow source-address

# Check the firewall rules
show firewall

# Make sure outgoing traffic is not being blocked
set firewall name WAN_LOCAL rule 100 action accept
set firewall name WAN_LOCAL rule 100 destination port 2055
set firewall name WAN_LOCAL rule 100 protocol udp
commit
save

2. High CPU Load

Symptoms:

  • CPU usage > 80%
  • Delays in packet processing

Solutions:

# Increase the sampling-rate
set system flow-accounting netflow sampling-rate 1000  # Was 100
commit

# Reduce max-flows
set system flow-accounting netflow max-flows 10000  # Was 100000
commit

# Disable Flow Accounting on non-critical interfaces
delete system flow-accounting interface eth2
commit
save

3. Flow Table Overflow

Symptoms:

  • Flows are dropped
  • Incomplete data on the collector

Solutions:

# Increase max-flows
set system flow-accounting netflow max-flows 200000
commit

# Reduce timeouts to free flows faster
set system flow-accounting netflow timeout flow-generic 1800  # Was 3600
set system flow-accounting netflow timeout tcp-generic 1800
commit
save

4. NetFlow Version Incompatibility

Symptoms:

  • The collector does not recognize the format
  • Parsing errors on the collector

Solutions:

# Try a different NetFlow version
delete system flow-accounting netflow version
set system flow-accounting netflow version 5  # The most compatible
commit

# Or use IPFIX (v10)
set system flow-accounting netflow version 10
commit
save

5. Aggregation Problems

Symptoms:

  • Too many or too few flows
  • Loss of detail

Solutions:

# Disable aggregation for full detail
delete system flow-accounting netflow aggregation
commit

# Or use selective aggregation
delete system flow-accounting netflow aggregation
set system flow-accounting netflow aggregation protocol-port
commit
save

Best Practices

1. Choosing a NetFlow Version

  • NetFlow v5: Use for maximum compatibility, IPv4 only
  • NetFlow v9: Use for IPv6 support and extended metadata
  • IPFIX (v10): Recommended for new deployments, standardized

2. Sampling

Recommendations for configuring the sampling-rate:

# For office networks (< 100 Mbps)
set system flow-accounting netflow sampling-rate 10

# For corporate networks (100-500 Mbps)
set system flow-accounting netflow sampling-rate 100

# For high-load networks (500 Mbps - 1 Gbps)
set system flow-accounting netflow sampling-rate 500

# For very high loads (> 1 Gbps)
set system flow-accounting netflow sampling-rate 1000

Important: The higher the sampling-rate, the lower the CPU load, but the lower the accuracy of traffic volume accounting.

3. Optimizing Timeouts

# For dynamic networks (many short-lived connections)
set system flow-accounting netflow timeout expiry-interval 30
set system flow-accounting netflow timeout tcp-fin 120
set system flow-accounting netflow timeout tcp-rst 60
set system flow-accounting netflow timeout udp 120

# For stable networks (long-lived connections)
set system flow-accounting netflow timeout expiry-interval 60
set system flow-accounting netflow timeout tcp-fin 300
set system flow-accounting netflow timeout tcp-rst 120
set system flow-accounting netflow timeout udp 300

4. Collector Redundancy

Always configure at least 2 collectors:

# Primary collector
set system flow-accounting netflow server 192.168.100.50 port 2055

# Backup collector (in a different network segment)
set system flow-accounting netflow server 192.168.200.50 port 2055

5. Monitoring Segmentation

Monitor only critical interfaces:

# Monitor external interfaces (internet)
set system flow-accounting interface eth0  # WAN1
set system flow-accounting interface eth1  # WAN2

# Do NOT monitor internal interfaces to save resources
# Exception: interfaces with critical traffic or for incident investigation

6. Limiting max-flows

Choose a reasonable max-flows value:

# For small networks (< 50 users)
set system flow-accounting netflow max-flows 10000

# For medium networks (50-200 users)
set system flow-accounting netflow max-flows 50000

# For large networks (> 200 users)
set system flow-accounting netflow max-flows 200000

7. Using source-address

Always specify the source-address explicitly:

# Use the management interface or loopback address
set system flow-accounting netflow source-address 192.168.0.1

# This helps identify the source on the collector
# Especially important when using multiple VyOS routers

8. Performance Monitoring

Check the load regularly:

# Check the CPU
show system resource

# Check the number of active flows
show flow-accounting interface eth0 | wc -l

# If CPU > 70%, increase the sampling-rate or reduce max-flows

9. Documenting the Configuration

Use comments to document your setup:

# NOTE: VyOS does not support comments in the configuration directly
# Document the configuration in a separate file or configuration management system

# Documentation example:
# eth0 - WAN1 (Rostelecom provider, 500 Mbps)
# eth1 - WAN2 (MTS provider, 300 Mbps)
# Collector 192.168.100.50 - primary (ntopng)
# Collector 192.168.200.50 - backup (ElastiFlow)

10. Security

Protect the NetFlow traffic:

# Configure a firewall to restrict access to the collectors
set firewall name LAN_OUT rule 100 action accept
set firewall name LAN_OUT rule 100 destination address 192.168.100.50
set firewall name LAN_OUT rule 100 destination port 2055
set firewall name LAN_OUT rule 100 protocol udp
set firewall name LAN_OUT rule 100 source address 192.168.0.1

# Consider using a VPN to protect the NetFlow traffic,
# especially when sending it across untrusted networks

Integration with Popular Collectors

ntopng

ntopng is a popular solution with a web interface for analyzing NetFlow/IPFIX.

VyOS configuration for ntopng:

configure

set system flow-accounting interface eth0
set system flow-accounting interface eth1
set system flow-accounting netflow version 9
set system flow-accounting netflow server 192.168.100.50 port 2055
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 100

commit
save
exit

nfsen/nfdump

nfsen/nfdump is a classic solution for storing and analyzing NetFlow.

VyOS configuration for nfsen:

configure

set system flow-accounting interface eth0
set system flow-accounting netflow version 5  # nfsen works great with v5
set system flow-accounting netflow server 192.168.100.50 port 9995
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow engine-id 1
set system flow-accounting netflow sampling-rate 100

commit
save
exit

ElastiFlow

ElastiFlow is a modern solution based on the Elastic Stack.

VyOS configuration for ElastiFlow:

configure

set system flow-accounting interface eth0
set system flow-accounting interface eth1
set system flow-accounting netflow version 10  # IPFIX
set system flow-accounting netflow server 192.168.100.50 port 4739
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 200
set system flow-accounting netflow timeout expiry-interval 60

commit
save
exit

Grafana + InfluxDB

Integration with InfluxDB requires an intermediate converter (for example, telegraf with the netflow plugin).

VyOS configuration:

configure

set system flow-accounting interface eth0
set system flow-accounting netflow version 9
set system flow-accounting netflow server 192.168.100.50 port 6343
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 100

commit
save
exit

Telegraf configuration on the server:

[[inputs.netflow]]
  service_address = "udp://:6343"
  protocol = "netflow v9"

[[outputs.influxdb]]
  urls = ["http://localhost:8086"]
  database = "netflow"

Full Enterprise Configuration Example

configure

# Description: Enterprise configuration for traffic monitoring
# Network: 1 Gbps internet link, 500 users
# Collectors: ntopng (primary), ElastiFlow (long-term storage)

# Interfaces for monitoring
set system flow-accounting interface eth0  # WAN (internet)
set system flow-accounting interface eth1  # LAN (corporate network)
set system flow-accounting interface eth2  # DMZ (servers)

# Core NetFlow settings
set system flow-accounting netflow version 10  # IPFIX for modern collectors
set system flow-accounting netflow source-address 10.0.0.1
set system flow-accounting netflow engine-id 1

# Collectors
set system flow-accounting netflow server 10.100.50.10 port 2055  # ntopng (primary)
set system flow-accounting netflow server 10.100.50.20 port 4739  # ElastiFlow (backup)
set system flow-accounting netflow server 10.200.50.10 port 2055  # Remote data center

# Sampling to balance accuracy and performance
set system flow-accounting netflow sampling-rate 500  # Every 500th packet

# Timeouts optimized for a corporate network
set system flow-accounting netflow timeout expiry-interval 60
set system flow-accounting netflow timeout flow-generic 3600  # 1 hour
set system flow-accounting netflow timeout tcp-generic 3600
set system flow-accounting netflow timeout tcp-fin 300  # 5 minutes
set system flow-accounting netflow timeout tcp-rst 120  # 2 minutes
set system flow-accounting netflow timeout udp 300  # 5 minutes
set system flow-accounting netflow timeout icmp 120

# Flow limit to prevent overload
set system flow-accounting netflow max-flows 100000

# Aggregation to reduce data volume while retaining detail
set system flow-accounting netflow aggregation protocol-port

commit
save
exit

Use Cases

1. Bandwidth Utilization Analysis

# Configure NetFlow for accurate accounting
configure
set system flow-accounting interface eth0
set system flow-accounting netflow version 9
set system flow-accounting netflow server 192.168.100.50 port 2055
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 10  # High accuracy
commit
save
exit

# Analysis on the collector will show:
# - Top users by traffic volume
# - Top applications/protocols
# - Traffic distribution across the time of day

2. Anomaly and Attack Detection

# Configure sensitive monitoring
configure
set system flow-accounting interface eth0  # External interface
set system flow-accounting netflow version 10
set system flow-accounting netflow server 192.168.100.50 port 4739
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 100
set system flow-accounting netflow timeout expiry-interval 30  # Fast updates
commit
save
exit

# The collector (ElastiFlow/ntopng) will help detect:
# - DDoS attacks (an abnormal number of packets)
# - Port scanning (many connections to different ports)
# - Data exfiltration (large volumes of outgoing traffic)

3. Regulatory Compliance

# Configure long-term metadata storage
configure
set system flow-accounting interface eth0
set system flow-accounting interface eth1
set system flow-accounting netflow version 10
set system flow-accounting netflow server 192.168.100.50 port 4739  # ElastiFlow
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 200
commit
save
exit

# On the collector side (ElastiFlow):
# - Configure data retention for 1+ year
# - Implement role-based access to the data
# - Set up audit logging of log access

4. Network Infrastructure Optimization

# Collect statistics for analysis
configure
set system flow-accounting interface eth0
set system flow-accounting interface eth1
set system flow-accounting interface eth2
set system flow-accounting netflow version 9
set system flow-accounting netflow server 192.168.100.50 port 2055
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 100
commit
save
exit

# The analysis will show:
# - Inefficient routes
# - Bottlenecks
# - Candidates for QoS policies
# - Underutilized links

Conclusion

Flow Accounting in VyOS is a powerful tool for monitoring, analyzing, and optimizing network traffic. Proper configuration enables:

  1. Performance monitoring: Tracking bandwidth utilization and identifying bottlenecks
  2. Security: Detecting anomalies, attacks, and unauthorized activity
  3. Planning: Forecasting traffic growth and planning capacity expansion
  4. Compliance: Meeting regulatory requirements for metadata retention
  5. Optimization: Identifying inefficient flows and optimizing routing

Key Recommendations

  • Use IPFIX (NetFlow v10) for new deployments
  • Configure at least 2 collectors for fault tolerance
  • Choose the sampling-rate based on the network load
  • Monitor CPU load and adjust parameters as needed
  • Regularly verify flow delivery to the collectors
  • Document the configuration and any changes

Useful Links

Note: This documentation applies to VyOS 1.4 (Sagitta) and VyOS 1.5 (Circinus). Flow Accounting functionality is stable across these versions.

Reviewed by OpenNix LLC · Last updated on
Console - Serial ConsoleFRR - FRRouting Configuration