Traffic by source

This check receives NetFlow v5/v9 or IPFIX from a router or switch. It shows the largest sources, destinations, protocols and connections by exported data volume.

1. Enable the appropriate export on the router or switch.

2. Enter the IP address of the central monitoring server as the export destination there.

3. On the associated device, open Configure → More checks and add Traffic by source.

4. Under Exporter source IP, enter the router/switch’s actual sender IP. A hostname is not allowed here.

5. Set Local UDP receive port, usually 2055, and configure the exporter to use the same port.

6. Set active export and template repetition on the exporter to 60 seconds. Export source/destination IP, protocol, ports, and byte and packet counters.

7. Allow UDP traffic from the exporter to the monitoring server.

8. Select Analysis period (minutes), from 1 to 60 minutes, with a default of five.

9. Click Test reception. The test waits up to 90 seconds for new records.

10. Click Save all.

Only data from the specified source IP is evaluated. Local UDP ports from 1.024 to 65.535 can be used. A total of at most 64 active flow exporters and 16 UDP reception ports can be configured. NetFlow/IPFIX is received centrally; a remote data collector does not handle this reception.

The device details show Top contributors, Sources and Destinations. The Connections and protocols section adds the corresponding top lists. The current top values can be opened as a history by clicking their labels. Evaluation uses one-minute intervals.

Where possible, use one measurement point per data flow and no sampled export if you want to evaluate unaltered data volumes. Multiple measurement points and sampling affect the exported counters. Network addresses and ports do not reliably establish an association with a particular person or application. Raw data is held in memory for at most one hour; the current top values receive measurement histories.