NetFlow bandwidth

Monitor → Infrastructure → NetFlow bandwidth shows traffic reported by routers, switches, and firewalls. The default Connections view shows source and destination IPs and ports beside application and protocol. Group by application, exporting device, source or destination address, port, protocol, interface, or observation domain. Select a table value to filter it, combine filters, and change the time window. Filters are kept in the page URL. The stacked area chart shows reported bytes by application in each receipt bucket. It includes the top eight labels plus Other, so smaller applications still contribute to the total. Select an application below the chart to inspect its connections and destinations. Both the chart and table follow the same filters and time window; missing buckets remain gaps.

Drag across the chart, adjust its time slider, or zoom to query usage for that interval. Reported traffic, packets, application totals, connection rows and shares all recalculate for the displayed interval. Its exact start and end are shown above the totals and retained in the page URL. Reset zoom restores the full selected window; Return to rolling window resumes the preset. Choosing another time window clears the selection. Collection health follows the same interval while remaining independent of traffic filters.

Enable a collector

1. Update an owned, private agent to a build that advertises NetFlow support.
2. Open Configure → Agents, select the agent, then choose Reconfigure. New installations include the same fields in the configuration wizard.
3. Set the UDP listener, for example 0.0.0.0:2055, and the allowed exporter IP addresses or CIDRs. Allow this UDP port through the host firewall.
4. Turn on Enable NetFlow collection and apply the reviewed configuration. The listener is disabled by default. Ports must be between 1024 and 65535.
5. Configure the network device to export NetFlow v5, NetFlow v9, or IPFIX over UDP to that agent. For v9/IPFIX, configure regular template refreshes.
6. Open Infrastructure → NetFlow bandwidth and select the collection agent.

UDP source addresses are an access filter, not authenticated device identities. Restrict exporters and network access to the intended devices. Shared agents cannot act as NetFlow collectors for borrowing accounts.

An enabled collector captures allowed exports without an automation rule. To restrict collection hours or add alert conditions, optionally create a rule in Ingest Automation and select the NetFlow source. Removing that action or deleting the rule restores normal collection; a source you explicitly disabled stays off. NetFlow is a continuous collector and does not appear among the agent’s running tests. Choose an independent signal, such as interface utilization, to start conditional collection. A NetFlow alert cannot start its own source. Same-agent conditions require a rule grouped by agent_id. The signed execution grant lasts at most 90 seconds; the listener stops when the grant expires, including during a control-plane outage.

Exporters continue sending while the listener is stopped. Those exports cannot be recovered. Waiting conditions and listener failures appear in the agent’s configuration issues; the explorer reports the last collector window received.

Read the traffic correctly

Bytes and packets are the deltas reported by the exporter. The explorer groups them into agent collection windows, rather than redistributing them over a flow’s duration. Export time, flow start/end time, and receipt time are retained separately. A burst of exports does not establish a burst of wire utilization.

Sampling is displayed as reported and is never multiplied into an estimated traffic total. Sampling available only through options templates is currently unknown. Missing exports, unknown templates, unsupported records, and bounded collector capacity can leave traffic incomplete. Collection gaps are separate from network packet loss. UDP delivery loss and duplicate exports are not detected. Absence of matching records does not establish zero traffic.

Application names supplied on the flow record are marked device label. Otherwise a recognized service port supplies a port estimate. These estimates do not identify a process or perform deep packet inspection. Unknown applications remain unknown. Interface numbers are exporter indices; zero means unspecified.

The Meraki MX NetFlow template exports addresses, ports, protocol and traffic counters, without application names. Netflix and Windows Update cannot be distinguished from generic HTTPS using these fields alone. Those names need an additional source of application evidence, such as Meraki Traffic Analytics. That source is not connected by enabling NetFlow.

NetFlow does not currently carry firewall allow/deny decisions in RouteSpear. For rejected traffic, the MX’s Appliance Flows syslog feed provides endpoints and firewall decisions. It is a separate feed and is not enabled by NetFlow forwarding. Missing flows, TCP resets and collection gaps do not prove that traffic was rejected. Source and destination reflect the export record; they are not automatically labelled outbound or inbound.

Collector, exporter, and observation domain stay visible in every grouping. Several exporters can observe the same packets, so account-wide totals can include overlapping observations. Narrow those identities before comparing traffic volumes. The table loads the top 200 groups and displays 25 per page by default. Use the row-count selector and previous/next controls to browse them. Sorting and table search apply to loaded groups; chart totals cover all exact-filter matches.

Alert rules

Open Configure → Alerts → Rules and select a template in the NetFlow category. Templates become applicable after the collector reports:

• NetFlow traffic volume sums reported bytes over five minutes, separately for each agent, exporter, and observation domain. Adjust its warning and critical thresholds to your network.
• NetFlow collection gaps reports decoder, missing-template, unsupported record, socket, or capacity failures. It describes collection quality.

The query editor also supports netflow_bytes, netflow_packets, and netflow_records. For example, filter an exporter and destination port before grouping bytes:

netflow_bytes{exporter="192.0.2.10",destination_port="443"} | sum by (agent_id, exporter, observation_domain)

Missing data remains indeterminate by default. Do not use sampled exported bytes as a link-capacity percentage without an independently established measurement.

For host-observed TCP behavior, see Passive network flows. NetFlow is independent of eBPF, OpenTelemetry, synthetic probes, and Path Health.