What is Netflow, and What are Netflow Endpoints?

Netflow is a catch-all term for a process originally developed by Cisco to respond to a need to gather information on a network's traffic flow and volume. This technology was further developed by the Internet Engineering Task Force (IETF) to become "Internet Protocol Flow Information eXport" or "IPFIX". Netflow works by capturing data from Netflow Endpoints and submitting that data to a Netflow Collector.

Sonar acts as a software-based Netflow Collector and serves to store the data sent to your instance by the Netflow Endpoints. Many network devices support Netflow, or some variant of it (e.g., IPFIX.) While there are a few variants, this documentation will refer to Netflow generally – just be aware that this endpoint supports Netflow version v1, v5, v7, v9, and IPFIX.

Supporting Netflow in Sonar is simple. You configure a Netflow endpoint in Sonar and specify the IP addresses you wish to allow Netflow data to be delivered from. You then configure your device to deliver Netflow data to Sonar, and Sonar will begin matching the IP addresses in the flows to your customers and storing data usage for them.

Creating a Netflow Endpoint

To create a new Netflow Endpoint, perform the below steps:

1. Navigate to Settings → Networking → Netflow Endpoints, and then click on Create Netflow Endpoint:
2. Next, supply a name to the Endpoint and select whether it will operate in Whitelist Mode:

3. With the Endpoint created, select Create Netflow Allowed Subnet:

1. This will open the creation modal for adding an allowed subnet to send Sonar Netflow traffic for data collection:

Creating a Netflow Endpoint with Whitelist mode

When creating a Netflow Endpoint, and you'd like to use Whitelist mode, the steps are very similar to the overall creation.

1. Navigate to Settings -> Networking -> Netflow Endpoints, and then click on Create Netflow Endpoint:
2. Next, with the Create Netflow Endpoint modal open, enter your endpoint name and ensure Whitelist Mode is checked:
3. With the Endpoint created, click on the Create Netflow Whitelist action button:
4. With the Create Netflow Whitelist modal open, enter one of the subnets you'd like to whitelist:

Configuring your Delivery Agent

Each device that can deliver Netflow is configured differently, but please see below for a quick tutorial on a MikroTik router.

First, open the IP menu and click on Traffic Flow.

If you only wish to collect data from certain interfaces (for example, if you have a single customer-facing interface), then select the appropriate interfaces in the Interfaces section. If this router handles a lot of traffic, you should limit the reporting interfaces to lessen the load on your router and your Sonar instance.

The Cache entries option controls the number of flows that can be in the router's memory simultaneously. If you have a high quantity of traffic, you should increase this – just be aware that it will increase memory consumption on your router. The values for Active/Inactive Flow Timeouts reflected in the above screenshot are the recommended settings.

Now click the Targets button and then the + button. When a Netflow Endpoint is configured in Sonar, a unique hostname is generated for your instance. To complete your Netflow setup, you'll need to perform a nslookup on the generated hostname:

nslookup [#####].sonarflow.net

Once that's done, enter the address of the Netflow Endpoint in the Dst. Address field, and the port you were provided when the Netflow Endpoint was created in Sonar in the Port field. Set the Version field to 5 and click OK:

After a few minutes, you will see data usage for your customers begin to tabulate on their accounts in Sonar.