NetFlow analyzer for your network

FlowSphera reads NetFlow, IPFIX and sFlow from the firewalls, routers and switches you already have — FortiGate, MikroTik, Palo Alto, Cisco, Juniper, Arista and more — and shows who talks to whom. Free up to 5,000 records per second; one command installs it on your own Linux server.

Install FlowSphera Setup guides

FlowSphera server address

config system netflow
    set active-flow-timeout 60
    config collectors
        edit 1
            set collector-ip <COLLECTOR_IP>
            set collector-port 2055
            set source-ip <FW_LAN_IP>
        next
    end
end
config system interface
    edit "wan"
        set netflow-sampler both
    next
    edit "internal"
        set netflow-sampler both
    next
end

FortiOS 7.x · NetFlow v9 · Step-by-step guide

/ip traffic-flow set enabled=yes interfaces=all active-flow-timeout=1m
/ip traffic-flow target add dst-address=<COLLECTOR_IP> port=2055 version=9

RouterOS 7 · NetFlow v9 · Step-by-step guide

Device > Server Profiles > NetFlow > Add
    Template refresh rate     1 minute
    Active timeout            1 minute
    NetFlow Server            <COLLECTOR_IP>   port 2055
    PAN-OS Field Types        tick (adds App-ID and User-ID names)

Network > Interfaces > each inside AND each Internet-facing interface
    Advanced > NetFlow Profile = the profile above

Commit

PAN-OS · NetFlow v9 · Full instructions

flow record FT-REC
 match ipv4 source address
 match ipv4 destination address
 match ipv4 protocol
 match transport source-port
 match transport destination-port
 match interface input
 match flow direction
 collect interface output
 collect counter bytes long
 collect counter packets long
 collect timestamp sys-uptime first
 collect timestamp sys-uptime last
flow exporter FLOWSPHERA
 destination <COLLECTOR_IP>
 transport udp 2055
 template data timeout 60
flow monitor FT-MON
 exporter FLOWSPHERA
 record FT-REC
 cache timeout active 60
interface GigabitEthernet0/0/0
 ip flow monitor FT-MON input
 ip flow monitor FT-MON output

IOS-XE · Flexible NetFlow · Step-by-step guide

Find your setup guide

FortiGateSwitch on NetFlow in FortiOS, see applications by name and what crosses each interface. Guide →MikroTikTwo RouterOS commands send every connection to FlowSphera. Guide →Palo AltoA NetFlow server profile with PAN-OS Field Types brings App-ID and User-ID names. Instructions →CiscoFlexible NetFlow with a flow direction field, so duplicate exports are removed. Instructions →

Also: Juniper, Check Point, SonicWall, Huawei, Arista, HPE Aruba, VyOS, pfSense and OPNsense, and Linux with pmacct. Anything that exports NetFlow, IPFIX or sFlow works, and the Connect device dialog has a ready-made configuration for each of these.

What you see once flows arrive

FlowSphera live map with arcs for new connections

Watch new connections arrive

Every new connection draws an arc on the map, from its country to your network. The same view runs full screen on a NOC wall, a 3D globe included.

FlowSphera path analysis with traffic moving along links

Follow traffic through your devices

Every device that exports flows, its neighbours and the traffic on each link, as both ends recorded it.

A real gap is shown only when traffic goes in and nothing comes back.

See who talks to whom

Pairs of hosts and the services between them, and which conversations appeared for the first time.

Application names, not only ports

FortiGate application names with their categories. For Palo Alto, App-ID and User-ID names once PAN-OS Field Types is ticked.

Know when something is wrong

Port scans, password guessing, floods, contact with known malicious addresses, links running full.

Alerts go to Telegram, e-mail, webhooks and your SIEM.

A PDF for the people who ask

Daily, weekly or monthly by e-mail, or for exactly the incident on your screen.

Three steps to a picture

First, install it on a Linux server.

curl -fsSL https://raw.githubusercontent.com/telesphera/flowsphera/main/install.sh | sudo bash

The installer sets up the database and the web interface over HTTPS, then prints the address and a ready-made configuration for your device.

Then point your device at it. On MikroTik that is two lines.

/ip traffic-flow set enabled=yes interfaces=all active-flow-timeout=1m
/ip traffic-flow target add dst-address=<FLOWSPHERA_IP> port=2055 version=9

FortiGate, Palo Alto and Cisco take a few more; the configuration for each is in the tool above and in the guides.

FlowSphera Connect device dialog with a ready configuration

Then open the map.

Records start appearing within a minute. The overview shows the whole network at a glance.

Free

Up to 5,000 flow records per second and 30 days of history. Every feature included. Covers homes and small and medium offices.

Install Community

Questions people ask

Which devices can send data to FlowSphera?

Anything that exports NetFlow v5/v9, IPFIX or sFlow, whether it is a firewall, a router or a switch: FortiGate, MikroTik, Palo Alto, Cisco, Juniper, Check Point, SonicWall, Huawei, Arista, HPE Aruba, pfSense and OPNsense, VyOS, Linux with pmacct and more. The installer prints a ready-made configuration for your vendor, and the guides on this site show each step.

Do I need agents, taps or mirror ports?

No. You switch on flow export on the device you already have and point it at the FlowSphera server. SNMP is optional and only adds interface names and addresses.

What hardware does it need?

A Linux server (Debian, Ubuntu, Fedora, RHEL, Rocky or Alma; x86_64 or arm64). One decoding worker handles about 40,000 records per second, four about 100,000, on a 4-core laptop-class CPU. Disk use is about 25 MB per million flow records. Community covers up to 5,000 records per second, enough for homes and small and medium offices.

Where does my data go?

Nowhere. FlowSphera is self-hosted: no cloud and no telemetry. A license check sends only the key, the server’s Instance ID and salted hashes of its hardware: no flow data, no addresses, nothing about your network.

Is it open source?

The source is public on GitHub under the Elastic License 2.0, which is source-available rather than OSI open source. Community is free for use on your own server.

What changes when I buy Pro?

Only the limits. Every feature is already in Community. A Pro license removes the records-per-second cap (or sets your own) and keeps history longer. When a license ends, the Community limits apply again and nothing is deleted.