See Where Your Bandwidth Goes, in Real Time

Netdata ingests NetFlow v5, v7, v9, IPFIX (NetFlow v10 / RFC 7011), and sFlow v5 flow records. All protocols are received on a single UDP listener (default port 2055) with automatic protocol detection from datagram headers — no per-protocol configuration required.

No. Netdata analyzes flow records that your network devices already export via NetFlow, IPFIX, or sFlow. There is no deep packet inspection or full packet capture — you get the who, what, and where of traffic without deploying any packet-capture infrastructure.

sFlow v5 uses statistical sampling, so byte and packet values in sFlow records are estimates rather than exact counts. Netdata processes sFlow flow samples (counter samples are not surfaced) and presents sampled data with appropriate context. sFlow VLAN information is available from ExtendedSwitch records.

Yes. You can group by up to 10 fields at once, including source/destination IP, port, protocol, ASN, AS name, country, state, city, VLAN, MAC address, BGP AS-path, MPLS labels, interface names, and more. The default grouping is Source AS Name, then Protocol, then Destination AS Name, which drives the Sankey diagram flow direction.

Flow records are stored in four disk-backed journal tiers: raw (full fidelity), 1-minute, 5-minute, and 1-hour rollups. Each tier has independent size and duration limits (defaults: 10 GB and 7 days per tier). Rollup tiers drop high-cardinality fields like raw IPs for compactness, while the raw tier preserves all detail.

Netdata’s ML anomaly detection runs on metrics across the entire platform — including network interface metrics and plugin health charts that the netflow-plugin emits. Flow records themselves are stored as journal entries. This means you get ML-powered anomaly detection on your network metrics alongside the flow analysis view, all within the same platform.

Each well-provisioned Netdata Agent handles approximately 50,000 to 100,000 sustained flow records per second. For larger deployments, distribute agents across your infrastructure and aggregate fleet-wide views through Netdata Parents and Netdata Cloud — this is the intended distributed architecture, not a workaround.

Packaged installs ship with a stock GeoIP and ASN database seed, providing country, state, city, and ASN enrichment with zero configuration. Additional enrichment modules include NetBox/IPAM integration, AWS/Azure/GCP cloud IP ranges, BGP routing via BMP or BioRIS, rule-based classifiers, static network metadata, and SRv6/VXLAN decapsulation — all applied at ingestion time.