# Flow Accounting - Network Flow Monitoring

> Configure and use Flow Accounting in VyOS to monitor network traffic with support for NetFlow v5, v9, IPFIX, and sFlow export protocols.

Source: https://opennix.org/en/docs/vyos/system/vyos-flow-accounting/


## Flow Accounting - Network Flow Monitoring

## Introduction

Flow Accounting is a mechanism for monitoring and analyzing network traffic that collects statistics about data flows passing through a router. VyOS supports several flow export protocols: NetFlow (versions 5, 9, and 10), IPFIX, and sFlow.

### Core Components

Flow Accounting consists of three main components:

1. **Exporter** - the VyOS router that collects packet information and aggregates it into flows
2. **Collector** - the server that receives and stores flow data
3. **Application** - software for analyzing and visualizing flow data

### Supported Protocols

- **NetFlow v5** - the classic version, supports IPv4 only
- **NetFlow v9** - an extended version with template support and IPv6
- **NetFlow v10 (IPFIX)** - the standardized version of NetFlow, RFC 7011
- **sFlow** - a packet sampling technology (not covered in this document)

## Basic Configuration

### Enabling Flow Accounting on Interfaces

Flow Accounting must be explicitly enabled on every interface where traffic monitoring is required:

```bash
set system flow-accounting interface eth0
set system flow-accounting interface eth1
set system flow-accounting interface eth2
```

### Configuring a NetFlow Collector

The minimal configuration for exporting flows to a collector:

```bash
# Configure the collector
set system flow-accounting netflow server 192.168.100.50 port 2055

# Select the NetFlow version
set system flow-accounting netflow version 9

# Specify the source address for NetFlow packets
set system flow-accounting netflow source-address 192.168.0.1
```

## NetFlow Version 5

NetFlow v5 is the most widely supported version, but it is limited to IPv4 traffic only.

### Complete NetFlow v5 Configuration

```bash
# Enable interfaces
set system flow-accounting interface eth0
set system flow-accounting interface eth1

# Configure NetFlow v5
set system flow-accounting netflow version 5
set system flow-accounting netflow server 192.168.100.50 port 2055
set system flow-accounting netflow source-address 192.168.0.1

# Configure the Engine ID (router identifier)
set system flow-accounting netflow engine-id 1

# Configure timeouts
set system flow-accounting netflow timeout expiry-interval 60
set system flow-accounting netflow timeout flow-generic 3600
set system flow-accounting netflow timeout tcp-generic 3600
set system flow-accounting netflow timeout tcp-fin 300
set system flow-accounting netflow timeout tcp-rst 120
set system flow-accounting netflow timeout udp 300

# Limit the maximum number of tracked flows
set system flow-accounting netflow max-flows 10000

# Apply the configuration
commit
save
```

### NetFlow v5 Parameters

- **engine-id** - a unique router identifier (0-255)
- **timeout expiry-interval** - the flow export interval in seconds (0-2147483647)
- **timeout flow-generic** - timeout for generic flows in seconds
- **timeout tcp-generic** - timeout for TCP connections
- **timeout tcp-fin** - timeout for TCP connections with the FIN flag
- **timeout tcp-rst** - timeout for TCP connections with the RST flag
- **timeout udp** - timeout for UDP flows
- **max-flows** - the maximum number of simultaneously tracked flows

## NetFlow Version 9

NetFlow v9 supports templates, IPv6, and extended metadata.

### NetFlow v9 Configuration

```bash
# Enable interfaces
set system flow-accounting interface eth0
set system flow-accounting interface eth1
set system flow-accounting interface eth2

# Configure NetFlow v9
set system flow-accounting netflow version 9
set system flow-accounting netflow server 192.168.100.50 port 2055
set system flow-accounting netflow source-address 192.168.0.1

# Configure the template refresh rate
set system flow-accounting netflow timeout template 60

# Configure timeouts
set system flow-accounting netflow timeout expiry-interval 60
set system flow-accounting netflow timeout flow-generic 3600

# Apply the configuration
commit
save
```

### Additional NetFlow v9 Parameters

- **timeout template** - the template transmission interval in seconds (1-86400)

## IPFIX (NetFlow v10)

IPFIX is the standardized version of NetFlow defined in RFC 7011. It is the recommended version for new deployments.

### IPFIX Configuration

```bash
# Enable interfaces
set system flow-accounting interface eth0
set system flow-accounting interface eth1

# Configure IPFIX (NetFlow v10)
set system flow-accounting netflow version 10
set system flow-accounting netflow server 192.168.100.50 port 4739
set system flow-accounting netflow source-address 192.168.0.1

# Configure timeouts
set system flow-accounting netflow timeout expiry-interval 60
set system flow-accounting netflow timeout flow-generic 3600
set system flow-accounting netflow timeout tcp-generic 3600
set system flow-accounting netflow timeout tcp-fin 300
set system flow-accounting netflow timeout tcp-rst 120
set system flow-accounting netflow timeout udp 300

# Apply the configuration
commit
save
```

### Standard Ports

- NetFlow v5/v9: port **2055** (UDP) is commonly used
- IPFIX: the standard port is **4739** (UDP)

## Sampling Rate

Sampling reduces the load on the router by analyzing only every Nth packet.

### Configuring Sampling

```bash
# Analyze every 100th packet
set system flow-accounting netflow sampling-rate 100

# Analyze every 1000th packet (for high-load networks)
set system flow-accounting netflow sampling-rate 1000

# Analyze every 10th packet (for small networks)
set system flow-accounting netflow sampling-rate 10
```

### Sampling Recommendations

| Network load | Recommended sampling-rate | Accuracy |
|---------------|----------------------------|----------|
| < 100 Mbps | 10-50 | High |
| 100-500 Mbps | 100-200 | Medium |
| 500 Mbps - 1 Gbps | 500-1000 | Basic |
| > 1 Gbps | 1000-5000 | Overview |

**Important**: Without sampling (sampling-rate 1) every packet is analyzed, which can lead to high CPU load under heavy traffic volumes.

## Configuring Multiple Collectors

VyOS supports exporting flows to multiple collectors simultaneously to ensure fault tolerance.

### Configuration with Multiple Collectors

```bash
# Primary collector
set system flow-accounting netflow server 192.168.100.50 port 2055

# Backup collector
set system flow-accounting netflow server 192.168.100.51 port 2055

# Collector in another data center
set system flow-accounting netflow server 10.200.50.10 port 2055

commit
save
```

## Aggregation

Aggregation lets you combine flows by specific criteria to reduce the volume of exported data.

### Configuring Aggregation

```bash
# Aggregate by source AS (Autonomous System)
set system flow-accounting netflow aggregation source-as

# Aggregate by destination AS
set system flow-accounting netflow aggregation destination-as

# Aggregate by source prefixes
set system flow-accounting netflow aggregation source-prefix

# Aggregate by destination prefixes
set system flow-accounting netflow aggregation destination-prefix

# Aggregate by protocol ports
set system flow-accounting netflow aggregation protocol-port

commit
save
```

### Aggregation Types

- **source-as** - grouping by source autonomous system
- **destination-as** - grouping by destination autonomous system
- **source-prefix** - grouping by source prefix
- **destination-prefix** - grouping by destination prefix
- **protocol-port** - grouping by protocol and port

## In-Memory Flow Table (not recommended for production)

VyOS can store flows in an in-memory table for local viewing.

### Configuring the Local Table

```bash
# WARNING: Not recommended for production!
set system flow-accounting buffer-size 10485760  # 10 MB

commit
save
```

**Warning**: Using a local flow table can lead to:
- Increased CPU load
- Unstable router operation
- Memory exhaustion under heavy load

We recommend using external collectors instead of a local table.

## Example for Yandex Cloud

### Exporting NetFlow to the Yandex Cloud Monitoring System

```bash
# VyOS configuration in Yandex Cloud
configure

# Enable Flow Accounting on the external and internal interfaces
set system flow-accounting interface eth0  # External interface
set system flow-accounting interface eth1  # Internal interface (subnets in the VPC)

# Configure IPFIX for export to a collector in Yandex Cloud
set system flow-accounting netflow version 10
set system flow-accounting netflow server 10.128.0.50 port 4739
set system flow-accounting netflow source-address 10.128.0.1

# Sampling to optimize load
set system flow-accounting netflow sampling-rate 200

# Configure timeouts
set system flow-accounting netflow timeout expiry-interval 60
set system flow-accounting netflow timeout flow-generic 3600
set system flow-accounting netflow timeout tcp-generic 3600
set system flow-accounting netflow timeout tcp-fin 300
set system flow-accounting netflow timeout tcp-rst 120
set system flow-accounting netflow timeout udp 300

# Limit the number of flows
set system flow-accounting netflow max-flows 50000

# Backup collector in another availability zone
set system flow-accounting netflow server 10.129.0.50 port 4739

commit
save
exit
```

### Integration with Yandex Monitoring

The following collectors can be used for integration with Yandex Monitoring:

- **ntopng** - deployed on a VM in Yandex Compute Cloud
- **ElastiFlow** - based on Elasticsearch in Yandex Managed Service for Elasticsearch
- **Grafana + ClickHouse** - for long-term storage and analysis

Example of installing ntopng on Ubuntu in Yandex Cloud:

```bash
# On the collector in Yandex Cloud
sudo apt-get update
sudo apt-get install software-properties-common wget
sudo add-apt-repository universe

wget https://packages.ntop.org/apt/ntop.key
sudo apt-key add ntop.key

echo "deb https://packages.ntop.org/apt/stable/ $(lsb_release -cs) main" | \
  sudo tee /etc/apt/sources.list.d/ntop-stable.list

sudo apt-get update
sudo apt-get install ntopng nprobe

# Configure nProbe to receive NetFlow/IPFIX
sudo nano /etc/nprobe/nprobe.conf
```

nProbe configuration:

```
--zmq=tcp://127.0.0.1:5556
--collector-port=4739
--collector-protocol=ipfix
-i=none
```

ntopng configuration:

```
--zmq=tcp://127.0.0.1:5556
-i=tcp://127.0.0.1:5556
```

## Example for VK Cloud

### IPFIX for Traffic Analysis in VK Cloud

```bash
# VyOS configuration in VK Cloud
configure

# Enable Flow Accounting on all active interfaces
set system flow-accounting interface eth0  # External interface (ext-net)
set system flow-accounting interface eth1  # Internal interface (private network)
set system flow-accounting interface eth2  # DMZ interface

# Configure IPFIX
set system flow-accounting netflow version 10
set system flow-accounting netflow server 10.0.10.100 port 4739
set system flow-accounting netflow source-address 10.0.10.1

# Moderate sampling to balance accuracy and performance
set system flow-accounting netflow sampling-rate 100

# Configure the Engine ID (unique router ID)
set system flow-accounting netflow engine-id 10

# Timeouts for different flow types
set system flow-accounting netflow timeout expiry-interval 60
set system flow-accounting netflow timeout flow-generic 3600
set system flow-accounting netflow timeout tcp-generic 3600
set system flow-accounting netflow timeout tcp-fin 300
set system flow-accounting netflow timeout tcp-rst 120
set system flow-accounting netflow timeout udp 300
set system flow-accounting netflow timeout icmp 300

# Maximum number of tracked flows
set system flow-accounting netflow max-flows 100000

# Aggregation by protocol and port to simplify analysis
set system flow-accounting netflow aggregation protocol-port

# Backup collector
set system flow-accounting netflow server 10.0.20.100 port 4739

commit
save
exit
```

### Using ElastiFlow in VK Cloud

ElastiFlow is a popular solution for analyzing NetFlow/IPFIX based on the Elastic Stack.

Installing ElastiFlow on a VM in VK Cloud:

```bash
# Install Docker
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh

# Create docker-compose.yml for ElastiFlow
mkdir elastiflow && cd elastiflow
nano docker-compose.yml
```

Example docker-compose.yml:

```yaml
version: '3'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.17.0
    container_name: elasticsearch
    environment:
      - discovery.type=single-node
      - "ES_JAVA_OPTS=-Xms2g -Xmx2g"
    ports:
      - "9200:9200"
    volumes:
      - esdata:/usr/share/elasticsearch/data

  kibana:
    image: docker.elastic.co/kibana/kibana:7.17.0
    container_name: kibana
    ports:
      - "5601:5601"
    environment:
      ELASTICSEARCH_HOSTS: http://elasticsearch:9200

  elastiflow:
    image: robcowart/elastiflow-logstash-oss:4.0.1
    container_name: elastiflow
    network_mode: host
    environment:
      - ELASTIFLOW_ES_HOST=127.0.0.1:9200
      - ELASTIFLOW_NETFLOW_IPV4_PORT=2055
      - ELASTIFLOW_SFLOW_IPV4_PORT=6343
      - ELASTIFLOW_IPFIX_TCP_IPV4_PORT=4739

volumes:
  esdata:
```

Starting ElastiFlow:

```bash
sudo docker-compose up -d
```

After startup, Kibana will be available at: `http://<VM_IP>:5601`

## Multi-Interface Configuration

### Selective Interface Monitoring

```bash
configure

# Monitor only external interfaces
set system flow-accounting interface eth0  # WAN1
set system flow-accounting interface eth1  # WAN2

# Exclude internal interfaces to reduce load
# set system flow-accounting interface eth2  # LAN - not monitored

# Configure NetFlow v9
set system flow-accounting netflow version 9
set system flow-accounting netflow server 192.168.100.50 port 2055
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 500

commit
save
exit
```

## Advanced Configuration with Filtering

### Configuration for Monitoring Only Critical Flows

```bash
configure

# Enable on all interfaces
set system flow-accounting interface eth0
set system flow-accounting interface eth1
set system flow-accounting interface eth2

# Configure IPFIX with aggressive sampling
set system flow-accounting netflow version 10
set system flow-accounting netflow server 192.168.100.50 port 4739
set system flow-accounting netflow server 192.168.100.51 port 4739  # Backup
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 1000  # Every 1000th packet

# Short timeouts for fast updates
set system flow-accounting netflow timeout expiry-interval 30
set system flow-accounting netflow timeout flow-generic 1800
set system flow-accounting netflow timeout tcp-generic 1800
set system flow-accounting netflow timeout tcp-fin 120
set system flow-accounting netflow timeout tcp-rst 60
set system flow-accounting netflow timeout udp 120
set system flow-accounting netflow timeout icmp 120

# Large flow count for high-load networks
set system flow-accounting netflow max-flows 500000

# Aggregation to reduce data volume
set system flow-accounting netflow aggregation protocol-port
set system flow-accounting netflow aggregation destination-prefix

commit
save
exit
```

## Verifying the Configuration

### Viewing the Current Configuration

```bash
# Show the entire Flow Accounting configuration
show configuration system flow-accounting

# Show only the NetFlow settings
show configuration system flow-accounting netflow
```

Example output:

```
flow-accounting {
    interface eth0
    interface eth1
    netflow {
        engine-id 1
        max-flows 10000
        sampling-rate 100
        server 192.168.100.50 {
            port 2055
        }
        source-address 192.168.0.1
        timeout {
            expiry-interval 60
            flow-generic 3600
            tcp-fin 300
            tcp-generic 3600
            tcp-rst 120
            udp 300
        }
        version 9
    }
}
```

## Operational Commands

### Viewing Flow Statistics

```bash
# Show flows on the eth0 interface
show flow-accounting interface eth0

# Show flows on the eth1 interface
show flow-accounting interface eth1

# Show flows for a specific host
show flow-accounting interface eth0 host 192.168.1.100

# Show the top 20 flows by traffic volume
show flow-accounting interface eth0 | head -20
```

Example output of `show flow-accounting interface eth0`:

```
flow-accounting for interface eth0

Src IP Addr:Port    Dst IP Addr:Port    Proto    Packets    Bytes
192.168.1.10:443    8.8.8.8:53         UDP      1234       567890
192.168.1.20:80     1.1.1.1:443        TCP      5678       2345678
192.168.1.30:22     10.0.0.50:54321    TCP      910        123456
```

### Filtering the Output

```bash
# Show only TCP flows
show flow-accounting interface eth0 | grep TCP

# Show only flows from a specific subnet
show flow-accounting interface eth0 | grep "192.168.1."

# Show flows to port 443 (HTTPS)
show flow-accounting interface eth0 | grep ":443"

# Show the top 10 flows sorted by bytes
show flow-accounting interface eth0 | sort -k5 -n -r | head -10
```

## Monitoring NetFlow Export

### Verifying That NetFlow Packets Are Sent

```bash
# Check active connections to the collector (on VyOS)
sudo netstat -anu | grep 2055

# Check using tcpdump
sudo tcpdump -i any port 2055 -n

# Check UDP traffic to the collector
sudo tcpdump -i any host 192.168.100.50 and port 2055 -vv
```

### Verifying on the Collector Side

```bash
# On the collector: listen for NetFlow packets
sudo tcpdump -i eth0 port 2055 -n -vv

# Check that the port is open on the collector
sudo netstat -anu | grep 2055
sudo ss -anu | grep 2055
```

## Troubleshooting

### Enabling Debug Mode

```bash
# Check the system logs
show log | grep flow

# Monitor system resources
show system resource

# Check CPU load
top
```

### Checking Collector Reachability

```bash
# Ping the collector
ping 192.168.100.50

# Check the route
traceroute 192.168.100.50

# Check UDP connectivity (requires nc/netcat)
nc -u 192.168.100.50 2055
```

### Common Problems and Solutions

#### 1. NetFlow Packets Do Not Reach the Collector

**Symptoms**:
- The collector receives no data
- tcpdump on VyOS shows outgoing packets, but the collector does not see them

**Solutions**:

```bash
# Verify that the source-address is correct
show configuration system flow-accounting netflow source-address

# Check the firewall rules
show firewall

# Make sure outgoing traffic is not being blocked
set firewall name WAN_LOCAL rule 100 action accept
set firewall name WAN_LOCAL rule 100 destination port 2055
set firewall name WAN_LOCAL rule 100 protocol udp
commit
save
```

#### 2. High CPU Load

**Symptoms**:
- CPU usage > 80%
- Delays in packet processing

**Solutions**:

```bash
# Increase the sampling-rate
set system flow-accounting netflow sampling-rate 1000  # Was 100
commit

# Reduce max-flows
set system flow-accounting netflow max-flows 10000  # Was 100000
commit

# Disable Flow Accounting on non-critical interfaces
delete system flow-accounting interface eth2
commit
save
```

#### 3. Flow Table Overflow

**Symptoms**:
- Flows are dropped
- Incomplete data on the collector

**Solutions**:

```bash
# Increase max-flows
set system flow-accounting netflow max-flows 200000
commit

# Reduce timeouts to free flows faster
set system flow-accounting netflow timeout flow-generic 1800  # Was 3600
set system flow-accounting netflow timeout tcp-generic 1800
commit
save
```

#### 4. NetFlow Version Incompatibility

**Symptoms**:
- The collector does not recognize the format
- Parsing errors on the collector

**Solutions**:

```bash
# Try a different NetFlow version
delete system flow-accounting netflow version
set system flow-accounting netflow version 5  # The most compatible
commit

# Or use IPFIX (v10)
set system flow-accounting netflow version 10
commit
save
```

#### 5. Aggregation Problems

**Symptoms**:
- Too many or too few flows
- Loss of detail

**Solutions**:

```bash
# Disable aggregation for full detail
delete system flow-accounting netflow aggregation
commit

# Or use selective aggregation
delete system flow-accounting netflow aggregation
set system flow-accounting netflow aggregation protocol-port
commit
save
```

## Best Practices

### 1. Choosing a NetFlow Version

- **NetFlow v5**: Use for maximum compatibility, IPv4 only
- **NetFlow v9**: Use for IPv6 support and extended metadata
- **IPFIX (v10)**: Recommended for new deployments, standardized

### 2. Sampling

Recommendations for configuring the sampling-rate:

```bash
# For office networks (< 100 Mbps)
set system flow-accounting netflow sampling-rate 10

# For corporate networks (100-500 Mbps)
set system flow-accounting netflow sampling-rate 100

# For high-load networks (500 Mbps - 1 Gbps)
set system flow-accounting netflow sampling-rate 500

# For very high loads (> 1 Gbps)
set system flow-accounting netflow sampling-rate 1000
```

**Important**: The higher the sampling-rate, the lower the CPU load, but the lower the accuracy of traffic volume accounting.

### 3. Optimizing Timeouts

```bash
# For dynamic networks (many short-lived connections)
set system flow-accounting netflow timeout expiry-interval 30
set system flow-accounting netflow timeout tcp-fin 120
set system flow-accounting netflow timeout tcp-rst 60
set system flow-accounting netflow timeout udp 120

# For stable networks (long-lived connections)
set system flow-accounting netflow timeout expiry-interval 60
set system flow-accounting netflow timeout tcp-fin 300
set system flow-accounting netflow timeout tcp-rst 120
set system flow-accounting netflow timeout udp 300
```

### 4. Collector Redundancy

Always configure at least 2 collectors:

```bash
# Primary collector
set system flow-accounting netflow server 192.168.100.50 port 2055

# Backup collector (in a different network segment)
set system flow-accounting netflow server 192.168.200.50 port 2055
```

### 5. Monitoring Segmentation

Monitor only critical interfaces:

```bash
# Monitor external interfaces (internet)
set system flow-accounting interface eth0  # WAN1
set system flow-accounting interface eth1  # WAN2

# Do NOT monitor internal interfaces to save resources
# Exception: interfaces with critical traffic or for incident investigation
```

### 6. Limiting max-flows

Choose a reasonable max-flows value:

```bash
# For small networks (< 50 users)
set system flow-accounting netflow max-flows 10000

# For medium networks (50-200 users)
set system flow-accounting netflow max-flows 50000

# For large networks (> 200 users)
set system flow-accounting netflow max-flows 200000
```

### 7. Using source-address

Always specify the source-address explicitly:

```bash
# Use the management interface or loopback address
set system flow-accounting netflow source-address 192.168.0.1

# This helps identify the source on the collector
# Especially important when using multiple VyOS routers
```

### 8. Performance Monitoring

Check the load regularly:

```bash
# Check the CPU
show system resource

# Check the number of active flows
show flow-accounting interface eth0 | wc -l

# If CPU > 70%, increase the sampling-rate or reduce max-flows
```

### 9. Documenting the Configuration

Use comments to document your setup:

```bash
# NOTE: VyOS does not support comments in the configuration directly
# Document the configuration in a separate file or configuration management system

# Documentation example:
# eth0 - WAN1 (Rostelecom provider, 500 Mbps)
# eth1 - WAN2 (MTS provider, 300 Mbps)
# Collector 192.168.100.50 - primary (ntopng)
# Collector 192.168.200.50 - backup (ElastiFlow)
```

### 10. Security

Protect the NetFlow traffic:

```bash
# Configure a firewall to restrict access to the collectors
set firewall name LAN_OUT rule 100 action accept
set firewall name LAN_OUT rule 100 destination address 192.168.100.50
set firewall name LAN_OUT rule 100 destination port 2055
set firewall name LAN_OUT rule 100 protocol udp
set firewall name LAN_OUT rule 100 source address 192.168.0.1

# Consider using a VPN to protect the NetFlow traffic,
# especially when sending it across untrusted networks
```

## Integration with Popular Collectors

### ntopng

ntopng is a popular solution with a web interface for analyzing NetFlow/IPFIX.

VyOS configuration for ntopng:

```bash
configure

set system flow-accounting interface eth0
set system flow-accounting interface eth1
set system flow-accounting netflow version 9
set system flow-accounting netflow server 192.168.100.50 port 2055
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 100

commit
save
exit
```

### nfsen/nfdump

nfsen/nfdump is a classic solution for storing and analyzing NetFlow.

VyOS configuration for nfsen:

```bash
configure

set system flow-accounting interface eth0
set system flow-accounting netflow version 5  # nfsen works great with v5
set system flow-accounting netflow server 192.168.100.50 port 9995
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow engine-id 1
set system flow-accounting netflow sampling-rate 100

commit
save
exit
```

### ElastiFlow

ElastiFlow is a modern solution based on the Elastic Stack.

VyOS configuration for ElastiFlow:

```bash
configure

set system flow-accounting interface eth0
set system flow-accounting interface eth1
set system flow-accounting netflow version 10  # IPFIX
set system flow-accounting netflow server 192.168.100.50 port 4739
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 200
set system flow-accounting netflow timeout expiry-interval 60

commit
save
exit
```

### Grafana + InfluxDB

Integration with InfluxDB requires an intermediate converter (for example, telegraf with the netflow plugin).

VyOS configuration:

```bash
configure

set system flow-accounting interface eth0
set system flow-accounting netflow version 9
set system flow-accounting netflow server 192.168.100.50 port 6343
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 100

commit
save
exit
```

Telegraf configuration on the server:

```toml
[[inputs.netflow]]
  service_address = "udp://:6343"
  protocol = "netflow v9"

[[outputs.influxdb]]
  urls = ["http://localhost:8086"]
  database = "netflow"
```

## Full Enterprise Configuration Example

```bash
configure

# Description: Enterprise configuration for traffic monitoring
# Network: 1 Gbps internet link, 500 users
# Collectors: ntopng (primary), ElastiFlow (long-term storage)

# Interfaces for monitoring
set system flow-accounting interface eth0  # WAN (internet)
set system flow-accounting interface eth1  # LAN (corporate network)
set system flow-accounting interface eth2  # DMZ (servers)

# Core NetFlow settings
set system flow-accounting netflow version 10  # IPFIX for modern collectors
set system flow-accounting netflow source-address 10.0.0.1
set system flow-accounting netflow engine-id 1

# Collectors
set system flow-accounting netflow server 10.100.50.10 port 2055  # ntopng (primary)
set system flow-accounting netflow server 10.100.50.20 port 4739  # ElastiFlow (backup)
set system flow-accounting netflow server 10.200.50.10 port 2055  # Remote data center

# Sampling to balance accuracy and performance
set system flow-accounting netflow sampling-rate 500  # Every 500th packet

# Timeouts optimized for a corporate network
set system flow-accounting netflow timeout expiry-interval 60
set system flow-accounting netflow timeout flow-generic 3600  # 1 hour
set system flow-accounting netflow timeout tcp-generic 3600
set system flow-accounting netflow timeout tcp-fin 300  # 5 minutes
set system flow-accounting netflow timeout tcp-rst 120  # 2 minutes
set system flow-accounting netflow timeout udp 300  # 5 minutes
set system flow-accounting netflow timeout icmp 120

# Flow limit to prevent overload
set system flow-accounting netflow max-flows 100000

# Aggregation to reduce data volume while retaining detail
set system flow-accounting netflow aggregation protocol-port

commit
save
exit
```

## Use Cases

### 1. Bandwidth Utilization Analysis

```bash
# Configure NetFlow for accurate accounting
configure
set system flow-accounting interface eth0
set system flow-accounting netflow version 9
set system flow-accounting netflow server 192.168.100.50 port 2055
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 10  # High accuracy
commit
save
exit

# Analysis on the collector will show:
# - Top users by traffic volume
# - Top applications/protocols
# - Traffic distribution across the time of day
```

### 2. Anomaly and Attack Detection

```bash
# Configure sensitive monitoring
configure
set system flow-accounting interface eth0  # External interface
set system flow-accounting netflow version 10
set system flow-accounting netflow server 192.168.100.50 port 4739
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 100
set system flow-accounting netflow timeout expiry-interval 30  # Fast updates
commit
save
exit

# The collector (ElastiFlow/ntopng) will help detect:
# - DDoS attacks (an abnormal number of packets)
# - Port scanning (many connections to different ports)
# - Data exfiltration (large volumes of outgoing traffic)
```

### 3. Regulatory Compliance

```bash
# Configure long-term metadata storage
configure
set system flow-accounting interface eth0
set system flow-accounting interface eth1
set system flow-accounting netflow version 10
set system flow-accounting netflow server 192.168.100.50 port 4739  # ElastiFlow
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 200
commit
save
exit

# On the collector side (ElastiFlow):
# - Configure data retention for 1+ year
# - Implement role-based access to the data
# - Set up audit logging of log access
```

### 4. Network Infrastructure Optimization

```bash
# Collect statistics for analysis
configure
set system flow-accounting interface eth0
set system flow-accounting interface eth1
set system flow-accounting interface eth2
set system flow-accounting netflow version 9
set system flow-accounting netflow server 192.168.100.50 port 2055
set system flow-accounting netflow source-address 192.168.0.1
set system flow-accounting netflow sampling-rate 100
commit
save
exit

# The analysis will show:
# - Inefficient routes
# - Bottlenecks
# - Candidates for QoS policies
# - Underutilized links
```

## Conclusion

Flow Accounting in VyOS is a powerful tool for monitoring, analyzing, and optimizing network traffic. Proper configuration enables:

1. **Performance monitoring**: Tracking bandwidth utilization and identifying bottlenecks
2. **Security**: Detecting anomalies, attacks, and unauthorized activity
3. **Planning**: Forecasting traffic growth and planning capacity expansion
4. **Compliance**: Meeting regulatory requirements for metadata retention
5. **Optimization**: Identifying inefficient flows and optimizing routing

### Key Recommendations

- Use IPFIX (NetFlow v10) for new deployments
- Configure at least 2 collectors for fault tolerance
- Choose the sampling-rate based on the network load
- Monitor CPU load and adjust parameters as needed
- Regularly verify flow delivery to the collectors
- Document the configuration and any changes

### Useful Links

- VyOS Flow Accounting: https://docs.vyos.io/en/latest/configuration/system/flow-accounting.html
- RFC 3954 - Cisco Systems NetFlow v9: https://www.rfc-editor.org/rfc/rfc3954
- RFC 7011 - IPFIX Protocol Specification: https://www.rfc-editor.org/rfc/rfc7011.html
- ntopng Documentation: https://www.ntop.org/guides/ntopng/
- ElastiFlow Documentation: https://github.com/robcowart/elastiflow

---

**Note**: This documentation applies to VyOS 1.4 (Sagitta) and VyOS 1.5 (Circinus). Flow Accounting functionality is stable across these versions.