NetFlow / IPFIX
Use detailed flow relationships for capacity, application and source-destination analysis.
TRAFFIC VISIBILITY
Realtime Traffic Analysis
Monitor live inbound and outbound traffic from NetFlow/IPFIX, sFlow and SPAN sources.
OPERATIONAL PURPOSE
Move from a network signal to verified context.
Correlate Mbps/Gbps, PPS, source and destination relationships across global, group, subnet and IP views.
Investigation workflow
Begin with the global condition, narrow the scope by direction and subnet, identify the responsible source and destination relationship, and compare the result with historical behavior before taking action.
CORE CAPABILITIESACTIVE
- Live throughput and packet-rate charts
- NetFlow/IPFIX and sFlow collector context
- SPAN and port-mirroring source visibility
- Top source and destination IPs
- IPv4 and IPv6 subnet drill-down
SHARED DATA CONTEXT
Built to work with the complete Flowtrion platform.
This module uses the same inventory and telemetry model as realtime analytics, security controls, historical reporting and BGP operations.
sFlow
Maintain scalable traffic and PPS visibility across high-speed, high-port-count environments.
SPAN / Port Mirroring
Add focused packet-copy visibility for critical services, VLANs and investigation points.
OPERATIONAL WORKFLOW
Realtime traffic analysis for faster network decisions
Realtime visibility helps NOC and security teams validate what is happening now instead of waiting for periodic reports. Flowtrion converts flow telemetry into continuously updated throughput, packet-rate, protocol, source, destination and subnet views.
Data inputs and analysis
The module processes NetFlow v5, NetFlow v9, IPFIX and sFlow records exported by routers, switches and firewalls. The quality and granularity of each view depend on the fields, interface counters and sampling configuration exported by the network device.
Traffic can be investigated by bits per second, packets per second, source and destination IP, port, protocol, interface and monitored subnet. This makes it easier to separate expected load from sudden bursts, scanning activity or an emerging volumetric event.
Operational outcomes
- Validate live incidents without waiting for batch reports.
- Identify the subnets, interfaces and top talkers driving a spike.
- Compare inbound and outbound behavior using a consistent timeline.
- Move from a dashboard signal to a filtered investigation workflow.
Deployment considerations
Start with representative edge, core and data-center exporters. Verify device clocks, active and inactive flow timeouts, template refresh intervals and sFlow sampling rates before defining operational baselines.
Realtime observations can be evaluated together with traffic history, anomaly detection, DNS, SMTP and BGP context to reduce false positives and shorten escalation time.