IPFIX Collector Tools
Overview of IPFIX Collector Tools
Internet Protocol Flow Information Export (IPFIX) is an IETF protocol that was created to address the need for a common, universal standard of export for Internet Protocol (IP) flow information from switches, routers, probes and other network devices. An IPFIX collector is one of three typical functional components used for IPFIX analysis:
- IPFIX Exporter: an IPFIX-enabled router, switch, probe or host software agent that tracks key statistics and other information about IP packet flows and generates flow records that are encapsulated in UDP and sent to a flow collector.
- IPFIX Collector: an application responsible for receiving flow record packets, ingesting the data from the flow records, pre-processing and storing flow record from one or more flow exporters.
- IPFIX Analyzer: a software application that provides tabular, graphical and other tools and visualizations to enable network operators and engineers to analyze flow data for various use cases, including network performance monitoring, troubleshooting, and capacity planning.
Main Functions of an IPFIX Collector
An IPFIX Collector’s main functions include:
- Ingesting flow UDP datagrams from multiple IPFIX-enabled devices
- Unpacking binary flow data into text/numeric formats
- Performing data volume reduction through selective filtering and aggregation
- Storing resulting data in flat files or SQL database
- Synchronizing flow data to the IPFIX analyzer application running on a separate computing resource
IPFIX Collector and Analyzer applications are two functions of an IPFIX analysis system or product. In some cases, the IPFIX analysis product implements both functions on the same server. This is appropriate when the volume of flow data being generated by exporters is relatively low and localized. In cases where flow data generation is high or where sources are geographically dispersed, the collector function can be run on separate and geographically distributed servers (such as rackmount server appliances). In these cases, collectors then synchronize their data to a centralized analyzer server.
Approaches to IPFIX Collection
Historically, the most common way to run IPFIX collectors was on a physical, rackmounted Intel-based server running a Linux OS variant. More recently, flow collectors have been deployed on virtual machines. Unfortunately, in either case, compute and storage is severely limited, which limits the amount of detailed data that could be retained or analyzed.
Most recently, a unified, cloud-scale approach to IPFX collector and analyzer architecture has emerged. In this architecture, a horizontally scalable big data system replaces physical or virtual collector and analyzer appliances. Big data systems allow for dramatically high volumes of ingest, greater data retention, deeper analytics and more powerful anomaly detection.
How Kentik Can Help with IPFIX Collection and Network Flow Analysis
Kentik offers a suite of advanced network monitoring solutions designed for today’s complex, multicloud network environments. The Kentik Network Observability Platform empowers network pros to monitor, run and troubleshoot all of their networks, from on-premises to the cloud. Kentik’s network monitoring solution addresses all three pillars of modern network monitoring, delivering visibility into network flow, powerful synthetic testing capabilities, and Kentik NMS, the next-generation network monitoring system.
To see how Kentik can bring the benefits of network observability to your organization, request a demo or sign up for a free trial today.
