IPFIX monitoring stack

Problem

Routers and switches can export flow records (IPFIX or NetFlow): who talks to whom, on which ports, how much and when. To use them you need a collector, storage that can query millions of records quickly, and dashboards that make the data readable. Many small and medium networks have none of these, so the records are never collected.

What I built

A self-contained Docker Compose stack that collects, enriches and analyses network traffic from IPFIX/NetFlow exports.

• Collection. The IPFIXcol2 collector receives IPFIX over UDP 4739 from a router or switch, or from the built-in synthetic traffic generator.
• Storage and enrichment. Flows are stored in ClickHouse. At insert time each flow gets protocol names, traffic direction (internal, inbound, outbound), QoS priority, ECN and readable TCP flags.
• Dashboards. Grafana comes with a provisioned datasource and a Network Security Overview dashboard: scan, brute-force and flood heuristics, spoofing checks, and a filterable flow table.
• Demo mode. Synthetic, privacy-safe traffic (documentation IP ranges only), so anyone can try the stack locally.
• Operations. Runs on a single host. Versions are pinned, secrets are only in .env, ClickHouse and Grafana are bound to localhost, and data is kept for 3–4 months.

Demo edition and production deployment

The repository on GitHub is a demo edition under the MIT licence. It is meant for trying the stack and seeing how it works, with synthetic traffic.

Running it on a real network needs more: sizing for your traffic and retention, onboarding of your exporters, access and security settings, detection tuned to your network, and someone who keeps it running. That is what I do for clients. On top of that I extend the stack with GeoIP/ASN enrichment, multiple exporters, alerting and pre-aggregated statistics.