Trisul Network Analytics
Developer Zone

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Configuring NetFlow in MikroTik ======


NetFlow is a network protocol developed by Cisco that provides network monitoring and accounting capabilities. MikroTik routers support NetFlow versions 1, 5, 9, and IPFIX. Here's a step-by-step guide to configuring NetFlow in MikroTik:

=====Step 1: Enable Traffic Flow=====

Enable Traffic Flow on the MikroTik router:
<code>
/ip traffic-flow set enabled=yes
</code>

=====Step 2: Specify Interfaces=====

Specify the interfaces to gather statistics for Traffic Flow. By default, all interfaces are used:
<code>
/ip traffic-flow set interfaces=all
You can specify specific interfaces by separating them with commas:
Code
/ip traffic-flow set interfaces=ether1,ether2
</code>

=====Step 3: Configure Cache Entries and Timeouts=====

Configure the cache entries and timeouts according to your needs:
<code>
/ip traffic-flow set cache-entries=4k active-flow-timeout=30m inactive-flow-timeout=15s
</code>

=====Step 4: Enable Packet Sampling (Optional)=====

Enable packet sampling if required:
<code>
/ip traffic-flow set packet-sampling=yes sampling-interval=2222 sampling-space=1111
</code>

=====Step 5: Specify NetFlow Target=====

Specify the IP address and port of the host that will receive NetFlow packets:
<code>
/ip traffic-flow target add dst-address=192.168.0.2 port=2055 version=9
You can specify the NetFlow version (1, 5, 9, or IPFIX) and other parameters as needed.
</code>

=====Step 6: Verify Configuration=====

Verify the Traffic Flow and target configurations:
<code>
/ip traffic-flow print
/ip traffic-flow target print
The router will now start sending NetFlow packets to the specified target.
</code>

**Example Configuration**

Here's an example configuration:
<code>
/ip traffic-flow set enabled=yes interfaces=all cache-entries=4k active-flow-timeout=30m inactive-flow-timeout=15s
/ip traffic-flow target add dst-address=192.168.0.2 port=2055 version=9
</code>

This configuration enables Traffic Flow on all interfaces, sets the cache entries to 4k, and specifies a target host with IP address 192.168.0.2 and port 2055 using NetFlow version 9.

**Mikrotik NetFlow Configuration Reference Doc**: [[https://help.mikrotik.com/docs/spaces/ROS/pages/21102653/Traffic+Flow|This Link points to source file]].