Monitoring Jobs in MSSQL with Zabbix
June 16, 2025
NETFLOW MONITORING WITH ZABBIX AND GRAFANA:
HOW WE DO IT AT MUUTECH 🔍
In corporate and industrial networks, understanding what traffic is flowing through the infrastructure is becoming increasingly important.
It’s not enough to know whether a router, a switch or a firewall is up: you also need to know which devices are communicating with each other, what protocols they use, how much traffic they generate and how that traffic evolves over time.
In this article we explain what NetFlow is, why it’s useful to monitor it, and how it can be integrated into a monitoring platform to get a clearer picture of network behavior.
📡 What Is NetFlow?
NetFlow is a technology originally developed by Cisco that collects information about the traffic flows passing through a network device. Instead of capturing the full contentof every packet, NetFlow summarizes communications into flow records.
A flow can include information such as:
- Source IP.
- Destination IP.
- Source port.
- Destination port.
- Protocol used.
- Input and output interface.
- Number of packets.
- Number of bytes.
- Traffic timestamp.
There are also other similar protocols and technologies, such as IPFIX, sFlow or J-Flow,which pursue a similar goal: providing visibility into how network traffic behaves.
This allows you to answer questions that are highly useful for operations, security andperformance analysis:
- Which devices are generating the most traffic?
- Which conversations are consuming the most bandwidth?
- Which protocols dominate the network?
- Which interface is traffic entering or leaving through?
- Has the traffic pattern changed compared to what’s normal?
🔍 Why Is NetFlow Monitoring Important?
Traditional network monitoring tends to focus on whether devices are available, whether an interface is up, or whether bandwidth usage exceeds a certain threshold.
That’s necessary, but it’s often not enough.
When saturation takes place, a performance drop or anomalous behavior appears, knowing that an interface is running at 90% utilization doesn’t answer the most important question: what’s actually generating that traffic.
Monitoring NetFlow helps provide a much more complete picture:
- Identifying the main traffic consumers.
- Detecting unexpected communications.
- Analyzing patterns by protocol.
- Understanding real interface usage.
- Investigating traffic spikes.
- Supporting diagnostic and troubleshooting tasks.
- Improving network visibility without needing to capture full packets.
In industrial environments, where IT and OT communications, supervisory systems, PLCs, servers, firewalls and inter-site links all coexist, this visibility can be especially valuable.
How Can NetFlow Be Monitored?
There are different ways of working with NetFlow and similar protocols.
Some solutions rely on dedicated commercial traffic-analysis tools. Others use open source collectors capable of receiving flows, processing them and storing them for later analysis.
In general terms, a NetFlow monitoring architecture usually includes:
- A network device that exports the flows.
- A collector that receives those flows.
- A storage system or database.
- A visualization layer.
- An alerting system or integration with a monitoring platform.
The key isn’t just collecting the data, but integrating it into the existing monitoring ecosystem. Having the information sitting in an isolated tool is of little use if it can’t later be cross-referenced with the rest of your infrastructure metrics.
Basic NetFlow Activation on Cisco Devices
On Cisco devices, basic NetFlow activation usually involves specifying which collector the flows will be sent to, which version will be used, and on which interfaces export should be enabled.
A simplified example would be:
ip flow-export destination <IP_COLECTOR> 2055
ip flow-export version 5
interface <INTERFAZ>
ip route-cache flowThe exact configuration can vary depending on the model, the IOS version and the type of NetFlow used, but the general idea is the same: the network device exports flow information to a central collector.
🚀 Integrating NetFlow into the Muutech Platform
At Muutech we’ve built a solution that integrates NetFlow information into our monitoring ecosystem.
Through pmacct, an open source tool specialized in collecting and processing NetFlow/IPFIX traffic, flows exported by network devices are received. In this architecture, pmacct acts as the collector: it listens for the flows sent by devices,processes them, and turns them into structured information for later analysis.
That information is then integrated into the usual tools of Muutech’s IT monitoring platform.
Zabbix centralizes monitoring, metric storage and alert management, while Grafana enables visual exploitation of the data through operational and analytical dashboards.
Within this ecosystem, Minerva acts as Muutech’s custom layer that centralizes and integrates this type of functionality alongside the rest of the monitoring capabilities.
This way, NetFlow stops being an isolated data source and becomes part of a broader view of the infrastructure.
Thanks to this integration, we can analyze:
- Recently detected flows.
- Traffic by source and destination IP.
- Main network conversations.
- Byte and packet volume.
- Most-used protocols.
- Input and output interfaces.
- Traffic evolution over time.
Beyond visualization, alerting is a key part of the solution. NetFlow information makes it possible to define alerts for situations such as the absence of expected traffic, anomalous volume increases, the appearance of unusual communications, sudden changes in traffic patterns, or behavior that may indicate saturation, misconfiguration or potential security incidents.
This way, monitoring isn’t limited to observing what’s happening on the network, it also enables automatic detection of deviations, so you can act before they impact operations.
⚗ Lab Test Results
To validate NetFlow monitoring, a network topology was set up in GNS3, made up of several Cisco routers and simulated end devices. In this environment, different PCs generate traffic between networks connected through routers R1, R2 and R3, while one of the routers exports NetFlow information to the collector.
This topology reproduces a simple but representative scenario: multiple sources and destinations communicating through different network interfaces. Based on these flows, the system can analyze which devices generate the most traffic, which paths it takes, which protocols are used, and how network consumption evolves over time.
Lab Topology used
Figure 1. GNS3 lab topology used to generate NetFlow traffic between several devices and routers.
General View of NetFlow Traffic
Figure 2. General view of NetFlow traffic.
This view lets you check recently detected flows, see enriched source and destination information, and analyze the traffic’s evolution over time in packets and bytes. It’s usefulas a starting point for spotting spikes, behavior changes or relevant communications.
Traffic by Interface and Top Conversations
Figure 3. Traffic by interface and top conversations.
One of the advantages of working with NetFlow is being able to analyze where traffic flows. This panel shows which interfaces traffic enters and exits through, as well as the conversations generating the most packets or bytes. This helps you understand which paths traffic follows within the network and which communications carry the most weight.
Top IPs and Protocols Used
Figure 4. Top IPs and traffic distribution by protocol.
This view lets you identify which IP addresses generate or receive the most traffic, which protocols dominate, and how data volume evolves over time. This information is useful for understanding normal network behavior and detecting communications that may fall outside expected patterns.
💡 Frequently Asked Questions About NetFlow Monitoring
Are NetFlow and SNMP the same thing?
No. SNMP reports a device’s status and performance (CPU usage, memory, the percentage of an interface’s utilization), but itdoesn’t explain what specific traffic is generating that load. NetFlow does: it shows which devices are communicating, over which protocol, and how much traffic they generate. The two technologies are complementary within a monitoring platform.
Which version of NetFlow is recommended?
NetFlow v5 is still the most widespread and compatible with most routers, although it has a fixed field format. NetFlow v9 andFlexible NetFlow are more recent and allow you to customize what information is exported, including IPv6 or Layer 2 data.
Do I need Cisco equipment to use NetFlow?
Not necessarily. Although NetFlow is aCisco technology, many vendors support NetFlow or offer equivalent protocols such assFlow, IPFIX or J-Flow, which pmacct is also able to process.
Is pmacct a paid tool?
No, pmacct is an open source tool. At Muutech we use it as aNetFlow/IPFIX collector and integrate it with Zabbix and Grafana to provide visualization, metric storage and alerting within a single platform.
✍️ Conclusion
Monitoring NetFlow makes it possible to move from a basic availability view to a much more complete picture of network behavior.
It’s not just about knowing whether an interface is up or whether there’s bandwidth usage, it’s about understanding which devices are communicating, what protocols they use, how much traffic they generate, and how that behavior evolves.
Thanks to the integration of pmacct with Muutech’s monitoring ecosystem, built on Zabbix and Grafana, this information can be incorporated into a broader platform, making it easier to analyze, detect anomalies and support decision-making.
In environments where the network is a critical part of operations, having this visibility helps reduce diagnostic times, get ahead of problems, and maintain a more controlled and predictable infrastructure.
Want to see this NetFlow monitoring running on your own infrastructure?
CEO & MANAGING DIRECTOR
Expert in IT monitoring, systems and networks.
Minerva is our enterprise-grade monitoring platform based on Zabbix and Grafana.
We help you monitor your network equipment, communications and systems!
Subscribe to our Newsletter
