Configuring Traffic Flow (NetFlow) on MikroTik for Network Monitoring Print

Hello again! It’s Emmanuel Corels from Emmanuel Corels Creatives. Today, we’re diving into a practical tool for keeping an eye on your network—Traffic Flow (often known as NetFlow). This feature lets your MikroTik router export detailed traffic statistics to a collector, so you can analyze bandwidth usage, identify heavy users, and troubleshoot network issues. Let’s walk through a simple, beginner-friendly setup.

What Is Traffic Flow (NetFlow)?

Traffic Flow is a feature that monitors network traffic in real time. It collects information about packets and sessions—like source/destination IPs, ports, and protocols—and exports this data to a monitoring system. With this information, you can:

• Analyze Bandwidth Usage: See which devices or applications consume the most data.
• Troubleshoot Issues: Identify abnormal traffic patterns or potential security threats.
• Plan for Growth: Understand traffic trends to plan network upgrades.

Step 1: Accessing Traffic Flow Settings

1. Open WinBox and connect to your MikroTik router.
2. Navigate to IP → Traffic Flow.

You’ll see options to enable traffic flow, set the collector’s address, port, and other parameters.

Step 2: Enabling Traffic Flow

1. Enable Traffic Flow:
   • Check the “Enabled” box.
2. Set the Collector Address:
   • Enter the IP address of your traffic analysis server or NetFlow collector (e.g., a PC running a tool like ntopng or SolarWinds).
3. Collector Port:
   • Typically, NetFlow uses port 2055 or 4739. Enter the port your collector is set to listen on.
4. Optional – Set the Source Interface:
   • You can specify an interface (e.g., your WAN interface) as the source for traffic flow data. This helps ensure accurate data collection.
5. Save Your Settings:
   • Click Apply or OK.

CLI Equivalent:

/ip traffic-flow set enabled=yes target=192.168.88.200:2055

(Replace 192.168.88.200 with your collector’s IP and adjust the port as needed.)

Step 3: Configuring Additional Parameters

While the default settings work well for many users, you might want to fine-tune a few parameters:

• Sampling Rate:
  • A lower sampling rate (e.g., 1:1) collects data for every packet, while a higher rate (e.g., 1:100) reduces load but provides a statistical overview.
  • For small networks, the default is often fine; for larger networks, adjust according to your collector’s capacity.
• Active Flow Timeout:
  • This defines how long a flow remains active before it’s exported. Defaults usually suffice, but if you’re monitoring short-lived sessions, a shorter timeout might be useful.
• Cache Timeout:
  • Determines how long flow records are kept before being considered inactive.

These settings are available in the Traffic Flow window, and you can adjust them based on your network’s size and your monitoring needs.

Step 4: Testing and Verifying Traffic Flow

1. Check the Collector:
   • On your NetFlow collector, start the monitoring tool and verify that it’s receiving data from your MikroTik.
2. Generate Some Traffic:
   • Browse websites, stream video, or use a bandwidth test tool. Your collector should start showing flows with source and destination IPs, ports, and protocols.
3. Monitor the Logs:
   • In WinBox, you can check logs under System → Log for any Traffic Flow-related messages if something isn’t working as expected.

Troubleshooting Tips

• No Data Reaching the Collector:
  • Double-check the collector’s IP address and port.
  • Verify that no firewall rules are blocking outbound UDP traffic on the chosen port.
• Collector Overload:
  • If the collector is overwhelmed, consider increasing the sampling rate to reduce the volume of data.
• Incorrect Source Interface:
  • Specify the proper interface if your router has multiple interfaces, ensuring that the data reflects the intended traffic.

Final Thoughts

With Traffic Flow configured on your MikroTik, you can now gather valuable insights about your network’s traffic. This information can help you optimize performance, troubleshoot issues, and plan for future growth. Start simple, and as you get more comfortable, fine-tune the settings to best suit your environment.

If you have any questions or run into issues, feel free to reach out. Happy monitoring, and here’s to a more informed and efficient network!

Explained with clarity by
Emmanuel Corels – Admin, Emmanuel Corels Creatives