Table of Contents
Configuring NetFlow in MikroTik
NetFlow is a network protocol developed by Cisco that provides network monitoring and accounting capabilities. MikroTik routers support NetFlow versions 1, 5, 9, and IPFIX. Here's a step-by-step guide to configuring NetFlow in MikroTik:
Step 1: Enable Traffic Flow
Enable Traffic Flow on the MikroTik router:
/ip traffic-flow set enabled=yes
Step 2: Specify Interfaces
Specify the interfaces to gather statistics for Traffic Flow. By default, all interfaces are used:
/ip traffic-flow set interfaces=all You can specify specific interfaces by separating them with commas: Code /ip traffic-flow set interfaces=ether1,ether2
Step 3: Configure Cache Entries and Timeouts
Configure the cache entries and timeouts according to your needs:
/ip traffic-flow set cache-entries=4k active-flow-timeout=30m inactive-flow-timeout=15s
Step 4: Enable Packet Sampling (Optional)
Enable packet sampling if required:
/ip traffic-flow set packet-sampling=yes sampling-interval=2222 sampling-space=1111
Step 5: Specify NetFlow Target
Specify the IP address and port of the host that will receive NetFlow packets:
/ip traffic-flow target add dst-address=192.168.0.2 port=2055 version=9 You can specify the NetFlow version (1, 5, 9, or IPFIX) and other parameters as needed.
Step 6: Verify Configuration
Verify the Traffic Flow and target configurations:
/ip traffic-flow print /ip traffic-flow target print The router will now start sending NetFlow packets to the specified target.
Example Configuration
Here's an example configuration:
/ip traffic-flow set enabled=yes interfaces=all cache-entries=4k active-flow-timeout=30m inactive-flow-timeout=15s /ip traffic-flow target add dst-address=192.168.0.2 port=2055 version=9
This configuration enables Traffic Flow on all interfaces, sets the cache entries to 4k, and specifies a target host with IP address 192.168.0.2 and port 2055 using NetFlow version 9.
Mikrotik NetFlow Configuration Reference Doc: This Link points to source file.