Network Traffic Flow Monitoring
Last updated – 20 July, 2026
Overview
Network traffic flow (NetFlow) monitoring collects IP network traffic as it enters or exits an interface. LogicMonitor Collectors receive and analyze data from resources that support common flow export protocols. LogicMonitor can report on the following statistics:
- Top talkers
- Top source/destination endpoints
- Top flows
- Top ports
- Top applications
- Quality of service (QoS)
The following network flow export protocols are supported:
- NetFlow versions 5, 7, and 9
- Flexible NetFlow
- IPFIX
- sFlow versions 1, 3, and 5.
- JFlow version 5
- NBAR2
Note:
- sFlow version 5 requires a LogicMonitor Collector version 29.105 or higher.
- The ability to collect NBAR2 data is limited to LogicMonitor Enterprise accounts and requires a LogicMonitor Collector version 29.101 or higher. If you intend to collect NBAR2 data, you must set the netflow.nbar.enable property on the LogicMonitor Collector to TRUE. For more information, see the “Configuring the LogicMonitor Collector for Network Traffic Flow Monitoring” section of this article.
For sampled flow exports, LogicMonitor applies sampling correction only when the exporter sends supported sampler option fields and sampling is enabled on the LogicMonitor Collector.
Standard IPFIX sampling Information Elements are not currently recognized. If the exporter provides only these sampling fields, sampled traffic may appear lower than the actual traffic volume.
LogicMonitor supports Autonomous System Number (ASN) visibility for NetFlow and IPFIX exports. ASN fields are not expected from sFlow exports.
Best Practices
- Ensure your Collector has the capacity to monitor network traffic flows. For more information, see Collector Capacity.
- Minimize network hops between the LogicMonitor Collector and the resource. Network flow records are sent using the UDP communications protocol. Because UDP delivery is not guaranteed, ensure the LogicMonitor Collector has the fewest network hops possible to the resource in order to minimize potential flow disruption due to network congestion or complexity.
- Synchronize clocks between the transmitting resource and the resource that is hosting the LogicMonitor Collector. If resources are located in different time zones, use UTC or standardize on a single time zone.
- Eliminate port conflict. The host that is collecting network traffic data must not have any other network traffic analyzer listening on the same port. This can cause contention and prevent traffic data from displaying in LogicMonitor.
- If the exporter uses sampling, confirm it emits supported sampler option fields.
- If ASN visibility is required, use a NetFlow or IPFIX exporter.
- Ensure the Collector feature flags required for NBAR and sampling are enabled when those optional templates are expected.
Configuring the LogicMonitor Collector for Network Traffic Flow Monitoring
By default, Collectors install with standard network traffic flow monitoring settings that do not require modification in most cases. However, you can override default settings to meet the unique needs of your monitoring environment.
netflow.enable | Boolean | TRUE | If TRUE, the network flow module is enabled on the Collector. |
netflow.ports | Integer | 2055 | The UDP listening port for network flow protocol data. The UDP port on the resource sending the flow data must match the UDP port specified here. You can configure multiple ports to support multiple protocols on multiple ports (for example, netflow.ports=2055,4739). |
netflow.sflow.ports | Integer | 6343 | The UDP listening port for sFlow protocol data. |
netflow.datadir | String | netflow | The path to the HSQL database. |
netflow.datadir.maxSizeInMB | Integer | 10240 | The maximum size, in megabytes, of the network flow data directory. |
netflow.log.maxNumPerMinute | Integer | 5 | The maximum number of log entries written per minute during network flow monitoring. |
netflow.netflow9.templateLife | Integer | 720 | The expiration time, in hours, of the NetFlow version 9 template. |
netflow.topFlowSamples | Integer | 1000 | The maximum number of top flow samples. Allowed values range from 100 to 2000. |
netflow.ignoreTimestampValidate | Boolean | FALSE | If TRUE, the Collector ignores network flow resource time information. Currently, the only known resources that require overriding the default FALSE value are SonicWall devices. |
netflow.nbar.enable | Boolean | FALSE | If TRUE, the Collector parses the applicationID and ApplicationType fields. Requires LogicMonitor Enterprise and Collector version 29.101 or later. |
netflow.ipv6.enabled | Boolean | TRUE | If FALSE, the Collector ignores flows with IPv6 addresses. |
netflow.log.largeBytesOrPackets | Integer | 1073741824 | Logs flows in Audit Logs with packet or byte counts greater than the specified integer value. |
netflow.sampling.enabled | Boolean | False | If TRUE, the Collector parses supported sampler option templates for NetFlow v9 and IPFIX (NetFlow v10) and applies sampling information. |
Enabling Network Traffic Monitoring in LogicMonitor
Network traffic monitoring is enabled on a per-resource basis.
To enable network traffic monitoring, do the following:
- In LogicMonitor, navigate to the Resources page and locate the resource you want to enable network traffic monitoring for.
- With the resource selected, select the Manage button.
- From the Manage page, toggle the Enable Network Flow Analysis switch.
- Select the Collector that will be used to receive exported network flow data. Network flow collection duties cannot be assigned to an Auto-Balanced Collector Group.
- Select Save.
Note: If your network flow exporter is sending data from an IP address that is not the same as the monitored IP address of the resource, customize the netflow.allowips property on the resource with the IP addresses from which network flow originates. This property accepts either a single IP or a comma-separated list as its value. For more information, see Resource and Instance Properties.
Enabling Network Traffic Flow Monitoring on a Resource
In addition to enabling network traffic monitoring in LogicMonitor, you must also enable it on your resource. Configurations vary depending on the resource, vendor, network topology, and protocol you are using. It is recommended that you review manufacturer guidelines for your specific resources.
The following resource configurations are applicable to all protocols:
- Network flow monitoring must be enabled per interface.
- A version number must be specified.
- A source interface for the flow exporter must be specified.
- The UDP port configured for the exporter must match the port specified in the Collector’s agent.conf file. For more information, see the “Configuring the LogicMonitor Collector for Network Traffic Flow Monitoring” section of this article.
- The clock on the resources should be synchronized with the clock on the Collector host.
- The IP address of the destination (the LogicMonitor Collector) must be specified.
- (NetFlow version 9 only) Additional template configuration options must be set.
- (sFlow only) Packet data must be provided in the
enterprise=0andformat=1packet configuration as described in RFC2233. In addition, sFlow uses port 6343. - (NBAR2) The option application-table and option application-attributes must be enabled on the exporter configuration of the resource. For more information, see Cisco’s NBAR Configuration Guide.
Sample Configurations
The following are sample NetFlow version 9 resource configurations. Because these sample configurations have the potential to become outdated as Cisco makes updates, refer to Cisco’s NetFlow Configuration and Flexible NetFlow Configuration guides to ensure up-to-date information.
Cisco IOS 3745 router – NetFlow Version 9, Main Cache Export
Configure global settings: source interface, NetFlow version, target NetFlow Collector, and UDP port.
To begin, enter the following at the command line:
Router#conf t
Then, enter the configurations for the global settings:
Router(config)#ip flow-export source FastEthernet0/0
Router(config)#ip flow-export version 9
Router(config)#ip flow-export destination 10.0.0.10 2055
Configure global template settings: refresh-rate, timeout-rate, and options.
To begin, enter the following at the command line:
Router#conf t
Then, enter the configurations for the global template settings:
Router(config)#ip flow-export template refresh-rate 15
Router(config)#ip flow-export template timeout-rate 90
Router(config)#ip flow-export template options export-stats
Router(config)#ip flow-export template options refresh-rate 25
Router(config)#ip flow-export template options timeout-rate 120
Configure the interface settings: enable route-cache flow
To begin, enter the following at the command line:
Router#conf t
Then, enter the configurations for the global template settings:
Router(config)#interface fa0/0
Router(config-if)#ip route-cache flow
Note (Palo Alto users): There is a limited ability to customize the name of Palo Alto interfaces. According to Palo Alto, the interface name cannot be edited. However, you do have the ability to append a numeric suffix to the interface name for subinterfaces, aggregate interfaces, VLAN interfaces, loopback interfaces, and tunnel interfaces.
Note (for Barracuda users): Those using Barracuda NG Firewalls exporting IPFIX/NetFlow v9 will need to consult Barracuda documentation for proper configuration. Specifically, you will need to adjust the following settings: change “Byte Order” to “LittleEndian” and change the IPFIX template for Export to “Default without Barracuda fields”.
Required and Supported Fields for NetFlow Exports
Core Fields
| Field Type | Number | Description | Comments |
| PROTOCOL | 4 | IP protocol type | Mandatory |
| IPV4_SRC_ADDR | 8 | IPv4 source address | Mandatory for IPv4 addresses. If the Collector is IPv6-enabled and flows contain IPv6 addresses, use IPV6_SRC_ADDR and IPV6_DST_ADDR instead. |
| IPV4_DST_ADDR | 12 | IPv4 destination address | Mandatory for IPv4 addresses |
| DIRECTION | 61 | Flow direction | Optional. If omitted, the default value 0 (ingress) is used. |
| SRC_TOS | 5 | Type of Service byte setting when entering the incoming interface | Optional |
| DST_TOS | 55 | Type of Service byte setting when exiting the outgoing interface | Optional |
| TCP_FLAGS | 6 | Cumulative TCP flags observed for the flow | Optional |
| LAST_SWITCHED_FT | 21 | System uptime when the last packet of the flow was switched | Optional. Defaults to the current epoch time if omitted. |
| FIRST_SWITCHED_FT | 22 | System uptime when the first packet of the flow was switched | Optional. Defaults to current epoch time minus 60 seconds if omitted. |
Multicast Group
| Field Type | Number | Description | Comments |
| IS-MULTICAST | 206 | Indicates whether the destination address is an IPv4 multicast address (224.0.0.0–239.255.255.255). The remaining bits are reserved. | Optional |
| REPLICATION_FACTOR | 99 | Multicast replication factor | Optional |
| MUL_DST_PKTS | 19 | IP multicast outgoing packet counter | Optional |
| MUL_DST_BYTES | 20 | IP multicast outgoing byte counter | Optional |
Interface Group
| Field Type | Number | Description | Comments |
| INPUT_SNMP | 10 | SNMP ingress interface index | At least one of INPUT_SNMP or OUTPUT_SNMP must be present. |
| OUTPUT_SNMP | 14 | SNMP egress interface index | At least one of INPUT_SNMP or OUTPUT_SNMP must be present. |
Bytes Group
| Field Type | Number | Description | Comments |
| IN_BYTES | 1 | Incoming byte counter for the IP flow | At least one of IN_BYTES or OUT_BYTES must be present. |
| OUT_BYTES | 23 | Outgoing byte counter for the IP flow | At least one of IN_BYTES or OUT_BYTES must be present. |
Source/Destination Port Group
| Field Type | Number | Description | Comments |
| L4_SRC_PORT | 7 | TCP/UDP source port | At least one of L4_SRC_PORT or L4_DST_PORT must be present. |
| L4_DST_PORT | 11 | TCP/UDP destination port | At least one of L4_SRC_PORT or L4_DST_PORT must be present. |
Packets Group
| Field Type | Number | Description | Comments |
| IN_PKTS | 2 | Incoming packet counter | At least one of IN_PKTS or OUT_PKTS must be present. |
| OUT_PKTS | 24 | Outgoing packet counter | At least one of IN_PKTS or OUT_PKTS must be present. |
NBAR Group
| Field Type | Number | Description | Comments |
| APPLICATION DESCRIPTION | 94 | Description of the application | At least one of APPLICATION DESCRIPTION or APPLICATION NAME must be present. |
| APPLICATION NAME | 96 | Application name associated with the classification | At least one of APPLICATION DESCRIPTION or APPLICATION NAME must be present. |
| APPLICATION TAG | 95 | Eight-bit engine ID followed by classification bits | Mandatory |
| APPLICATION GROUP | 12234 / 45002 | Groups related networking applications | At least one of the following must be present: APPLICATION GROUP, CATEGORY, ENCRYPTED, P2P TECHNOLOGY, SUB-CATEGORY, or TUNNEL TECHNOLOGY. |
| CATEGORY | 12232 / 45000 | First-level application category | Same requirement as above |
| ENCRYPTED | 290 | Indicates whether the application is encrypted | Same requirement as above |
| P2P TECHNOLOGY | 288 | Indicates whether the application uses peer-to-peer technology | Same requirement as above |
| SUB-CATEGORY | 12233 / 45001 | Second-level application category | Same requirement as above |
| TUNNEL TECHNOLOGY | 289 | Indicates whether the application tunnels other protocols | Same requirement as above |
IPv6 Group
| Field Type | Number | Description | Comments |
| IPV6_SRC_ADDR | 27 | IPv6 source address | Mandatory for IPv6 flows |
| IPV6_DST_ADDR | 28 | IPv6 destination address | Mandatory for IPv6 flows |
| IPV6_SRC_MASK | 29 | IPv6 source mask length | Optional |
| IPV6_DST_MASK | 30 | IPv6 destination mask length | Optional |
| IPV6_FLOW_LABEL | 31 | IPv6 flow label (RFC 2460) | Optional |
Sampling Group
| Field Type | Number | Description | Comments |
| FLOW_SAMPLER_ID | 48 | Identifier shown in “show flow-sampler” | Optional |
| FLOW_SAMPLER_MODE | 49 | NetFlow v9-style sampling mode uses algorithm type 0x02: random sampling | Optional |
| SAMPLING_ALGORITHM | 35 | NetFlow v9-style sampling algorithm: 0x01 deterministic sampling, 0x02 random sampling | Optional |
| FLOW_SAMPLER_RANDOM_INTERVAL | 50 | Packet interval at which to sample. Use in connection with FLOW_SAMPLER_MODE | Optional |
| SAMPLING_INTERVAL | 34 | Packet interval at which to sample | Optional |
| SAMPLER_NAME | 84 | Flow sampler name | Optional |
Note:
- LogicMonitor currently supports the NetFlow v9-style sampling fields above.
- Standard IPFIX sampling Information Elements selectorAlgorithm (304), samplingSize (309), and samplingPopulation (310) are not supported.
Extended Cisco ASA Device Group
| Field Type | Number | Description | Comments |
| NF_F_CONN_ID | 148 | Unique flow identifier | Optional |
| NF_F_FLOW_CREATE_TIME_MSEC | 152 | Flow creation timestamp | Optional |
| NF_F_EVENT_TIME_MSEC | 323 | Event timestamp in milliseconds since 1970-01-01 UTC | Optional |
| NF_F_FLOW_BYTES | 85 | Flow byte count | Mandatory for Cisco ASA 9.0 |
| NF_F_FW_EVENT_90 | 40005 | Firewall event | At least one of NF_F_FW_EVENT_90 or NF_F_FW_EVENT_91 must be present. |
| NF_F_FW_EVENT_91 | 233 | Firewall event code (Flow created, deleted, denied, alert, update) | At least one of NF_F_FW_EVENT_90 or NF_F_FW_EVENT_91 must be present. |
| NF_F_FWD_FLOW_DELTA_BYTES | 231 | Source-to-destination byte delta | Mandatory for Cisco ASA 9.1 |
| NF_F_REV_FLOW_DELTA_BYTES | 232 | Destination-to-source byte delta | Mandatory for Cisco ASA 9.1 |
IPFIX / NetFlow Version 10 Group
| Field Type | Number | Description | Comments |
| flowStartSeconds | 150 | Timestamp of the first packet | Optional |
| flowEndSeconds | 151 | Timestamp of the last packet | Optional |
| flowEndMilliseconds | 153 | Timestamp of the last packet (milliseconds) | Optional |
| systemInitTimeMilliseconds | 160 | Timestamp of the last IPFIX device initialization | Optional |
Note:
LogicMonitor supports only the specific IPFIX fields listed below, not full generic IPFIX support.
- Flow records and IPv6 flow fields.
- BGP ASN fields.
- NBAR application fields.
- Cisco ASA / NSEL fields and NetFlow v9-style sampler option data.
Viewing Network Traffic Flow Data
Network traffic flow data is displayed on the Traffic tab on the Resources page for an enabled resource. For more information, see Viewing, Filtering and Reporting on Network Traffic Flow Data.
