Netflow Collector |best| -

Ready to deploy your own? Start with pmacct (lightweight) or Elastiflow (full-stack) on a VM with 4 vCPUs and 16GB RAM – sufficient for 50k flows/sec.

While Simple Network Management Protocol (SNMP) can tell you how much traffic is passing through an interface (e.g., "Interface Gi0/1 is at 80% utilization"), it cannot tell you who is generating that traffic. netflow collector

To understand the value of a Collector, you must understand the "Flow Record." A collector typically receives the following tuple of information for every single flow: Ready to deploy your own

Implementing a NetFlow Collector is not without its difficulties. "Interface Gi0/1 is at 80% utilization")

On high-speed interfaces (10Gbps+), generating a flow record for every packet can overwhelm the router's CPU.