Complete NetFlow Collector and Analyzer

See which devices, protocols, and services use your bandwidth – and act before it becomes a problem

How does a NetFlow collector turn flow data into actionable traffic analysis?

A NetFlow collector receives flow data from your network devices and turns it into structured traffic analysis: who's talking to whom, on which port, using which protocol. Most setups require separate tools for collection, analysis, and visualization before you get a usable breakdown. Paessler PRTG combines all three in a single tool, giving you Top Talkers, Top Connections, and Top Protocols per interface with flow sensors included in every license. It supports NetFlow v5/v9, IPFIX, sFlow, and jFlow v5, so most environments are covered without additional software.

Supported technologies: Cisco (NetFlow v5/v9), Juniper (jFlow v5), HP/Aruba/Brocade (sFlow), Fortinet, VMware, and any IPFIX-compatible device. For devices without native flow export, PRTG's SNMP Traffic monitoring covers the gap.

Note: PRTG flow sensors currently support IPv4 traffic. If your environment routes significant IPv6 traffic, factor that into your deployment planning.

Download PRTG Trial

PRTG is compatible with all major vendors, products, and systems

What PRTG's NetFlow Monitoring Gives You

Complete Clarity on Who Uses Your Bandwidth and How

SNMP tells you how much bandwidth an interface uses in total. Flow data breaks that down further: which device, which protocol, which connection is responsible for the traffic you're seeing. PRTG receives the flow traffic your routers, switches, and firewalls are already generating and translates it into a per-interface breakdown by source IP, destination IP, port, and protocol. Top Talkers, Top Connections, and Top Protocols are visible in continuously updated dashboards and historical graphs. No custom sensor configuration required on the PRTG side. Predefined channels work once the flow export is configured on the device. A bandwidth problem that used to take hours to narrow down becomes a two-minute lookup, or close to it.

Per-interface traffic breakdown by source IP, destination IP, port, and protocol
Top Talkers, Top Connections, and Top Protocols: predefined channels, no additional sensor configuration needed
Covers routers, switches, firewalls, and VPN concentrators
Traffic visualized in live dashboards and historical trend graphs
Predefined filters for the most common traffic categories: FTP/P2P, RDP/SSH, DHCP/DNS, SMTP/IMAP, and more. FTP/P2P in particular tends to be the first thing worth checking during unexplained bandwidth spikes.

Everything You Need in One Place with No Extra Stack

Many NetFlow collectors are receive-only. You still need a separate analyzer, a database backend, and a visualization layer before you see a single useful graph. PRTG receives flow data and analyzes it in the same tool, with flow sensors included in every license and ready to configure the moment you install. You point a device at PRTG's IP, configure the export on the device side, and you're getting structured, visual flow data alongside your existing network monitoring for servers and applications.

NetFlow collection and analysis natively in one tool
No add-ons, no extra cost
Works alongside PRTG's existing network, server, and application monitoring
Replaces the need for separate open-source collector/analyzer combinations
Supports NetFlow v5/v9, IPFIX, sFlow, and jFlow v5 from a single installation

Traffic Data Focused on What You Actually Need to See

Flow data volume grows fast. Collecting everything from every interface without filtering by protocol, port, or IP range just creates more noise to sift through. PRTG's flow sensors come with predefined channel filters for the most common traffic categories, no scripting needed on the sensor side. Custom sensor variants let you define channels by source address, TCP/UDP port, or protocol when you need more precision. Metrics are stored and graphed per channel, so trend data for troubleshooting and capacity planning is always there.

Predefined channels: Citrix, FTP/P2P, DNS/DHCP/ICMP, SMTP/IMAP/POP3, RDP/SSH/Telnet/VNC
Custom sensor variants for filtering by source address, destination, TCP/UDP port, or protocol
Configure separate sensors per interface, so you focus only on the links that matter
Metrics stored and graphed per channel for trend visibility and capacity planning
You can run standard and custom sensors across the same environment, and that's the common setup

See Why IT Professionals Trust PRTG

Start monitoring your infrastructure in minutes. No professional services, no complex configuration, no risk.

Free download

PRODUCT OVERVIEW

Automated Traffic Alerts Across Your Entire Flow Data

Automated alerting on flow data means your monitoring catches bandwidth issues on its own and notifies the right person, whether you're watching the dashboard at that moment or not. PRTG applies configurable threshold-based alerts to every flow sensor channel. When a defined limit is crossed on total interface bandwidth or a specific traffic category, it sends a notification via email, SMS, push, or external integrations if you're routing to something like PagerDuty or ServiceNow. Flow alerting is unified with your SNMP and uptime monitoring in a single alert system.

Configurable thresholds on any flow sensor channel
Notifications via email, SMS, push, and external integrations
Alert on total interface bandwidth or specific protocol/traffic category channels
Flow alerting unified with SNMP and uptime monitoring in a single alert system. Maintenance windows, acknowledgment, and pause scheduling are included in the same system, not bolted on separately.

How PRTG Collects and Processes Flow Data

PRTG's flow monitoring is built on standard flow export protocols. The sections below cover how flow data gets from your network devices into PRTG, what the individual protocols look like in practice, and how PRTG's sensor layer handles each one. Flow sensors run on PRTG probes. In multi-site environments, distributed probe deployment lets you act as a local flow collector per site, with each probe managing its own sensor load independently.

Flow Collection

Routers, switches, and firewalls track active connections and periodically export those records as UDP datagrams to a designated collector endpoint. The data collection process starts on the device side: the IP address and UDP port of the collector are configured on the exporting device. Once the device-side export is in place, PRTG's probe begins processing records as they arrive. Each flow record contains source and destination IP, source and destination port, protocol, byte and packet counts, and timestamps. PRTG's flow sensors parse these records and map them to the channel structure visible in the dashboard.

NetFlow Support

NetFlow v5 is the fixed-format standard with broad support on Cisco IOS devices. Straightforward to configure, predictable in structure. NetFlow v9 is the template-based evolution: field definitions are negotiated via templates, which makes the format more flexible and forms the technical basis for IPFIX. PRTG provides both a standard sensor with predefined channels and a Custom sensor variant for each NetFlow version, so you can start with defaults and extend where needed.

IPFIX Support

IPFIX (IP Flow Information Export) is the IETF-standardized extension of NetFlow v9. Vendor-neutral, extensible, and supported by a wide range of modern equipment including Fortinet and VMware. Like NetFlow v9, it's template-based, which means vendors can include custom fields beyond the standard set. PRTG's IPFIX sensor handles standard field definitions; the IPFIX Custom sensor lets you work with environments that use extended or proprietary fields.

sFlow & jFlow

sFlow takes a different approach: rather than tracking every flow, it samples every n-th packet and extrapolates traffic patterns from that sample. This puts less CPU load on the exporting device, which is why it's common on HP/Aruba and Brocade hardware that doesn't support NetFlow natively. One deployment note: sFlow Custom sensors carry a high performance impact on the PRTG probe side. Keep the number of sFlow Custom sensors per probe in check and plan probe capacity accordingly.

jFlow v5 is Juniper's proprietary flow export format, functionally equivalent to NetFlow v5, with dedicated standard and Custom sensor variants in PRTG. PRTG supports jFlow v5 specifically. If your Juniper devices are exporting a later jFlow format, verify compatibility before deploying.

A Note on IPv4: All PRTG flow sensors (NetFlow, IPFIX, sFlow, and jFlow) process IPv4 traffic. IPv6 flow data is not currently supported. For environments with mixed or predominantly IPv6 traffic, factor this into your monitoring coverage planning.

SNMP Fallback

For network devices that don't support any flow export protocol, PRTG's SNMP Traffic sensor provides interface-level performance monitoring: total traffic in/out, broadcast/multicast/unicast packet counts, discards, and errors. It's not flow-level granularity, but it means no device in your environment is left without coverage. PRTG handles both flow and SNMP monitoring within the same setup, so there's no gap and no separate tool to manage for edge devices or simpler nodes.

free downLoad

NetFlow Collector Features: Manual Monitoring vs. PRTG

FEATURE	Without PRTG Without PRTG	With PRTG With PRTG
Identify Top Talkers, Top Connections, Top Protocols	Without PRTG CLI queries per device, one at a time	With PRTG Top Talkers, Top Connections, Top Protocols per interface
Multi-protocol flow collection	Without PRTG Separate tools per protocol	With PRTG NetFlow v5/v9, IPFIX, sFlow, jFlow v5 in one
Traffic alerting	Without PRTG Manual checks, no automation	With PRTG Configurable threshold alerts on any flow sensor channel
Traffic visualization	Without PRTG Raw data exports, external tools needed	With PRTG Live dashboards and historical trend graphs
Devices without flow support	Without PRTG No visibility	With PRTG SNMP Traffic sensor covers the gaps

free downLoad

“We strive to equip our systems with state-of-the-art technology to safeguard our educational practices for the future. Part of this includes ensuring that all our systems run smoothly at all times. On any given day, we rarely have time to keep an eye on all our systems. We therefore decided to monitor our school’s IT environment with a centralized network monitoring tool.”

Stefan Roschewitz, IT administrator

BBS Holzminden

“We want to include the tool in our set of solutions in order to solve problems more proactively in our technology infrastructure. PRTG has exceeded all our expectations because it is a reliable, extremely easy-to-use solution. There is no doubt that it lives up to the renowned quality of German technology.”

Esbin Saúl Lázaro García, IT Infrastructure and Security Engineer

Hospital El Pilar

“The reactivity, know-how, and technical solutions of Paessler are outstanding in every situation. For me, no monitoring tool compares to PRTG.”

Andreas Reimann, Senior Networking Communication Architect

Zurich Airport

Paessler PRTG Network Monitor licenses & pricing

Choose the PRTG Network Monitor subscription that's best for you.

License Name	Price	License Details	Get started	Pricing Details
PRTG 500	^$200	per month paid annually	Buy now Buy now	Enough to monitor multiple aspects of 50 devices
PRTG 1000	^$358	per month paid annually	Buy now Buy now	Enough to monitor multiple aspects of 100 devices
PRTG 2500	^$742	per month paid annually	Buy now Buy now	Enough to monitor multiple aspects of 250 devices
PRTG 5000	^$1,300	per month paid annually	Buy now Buy now	Enough to monitor multiple aspects of 500 devices
PRTG 10000	^$1,642	per month paid annually	Buy now Buy now	Enough to monitor multiple aspects of 1000 devices

Over 100,000 Customers Worldwide Love Paessler

NetFlow Collector: Frequently Asked Questions

What is a NetFlow collector, and how is it different from a NetFlow analyzer?

A NetFlow collector is the component that receives flow data exported by network devices and stores or processes it. A NetFlow analyzer is what interprets that data and turns it into readable traffic breakdowns. In many setups these are separate tools. You need both to get anything useful out of your flow data. PRTG combines both functions: it receives flow records and immediately makes the analyzed data available as structured sensor channels and dashboard visualizations. No separate analyzer component needed. No extra setup.

Which NetFlow versions and flow protocols does PRTG support?

PRTG supports NetFlow v5 and v9, IPFIX, sFlow, and jFlow v5. For each protocol, there's a standard sensor with predefined channels and a Custom sensor variant that lets you define your own channel filters by IP range, port, or protocol. This covers the vast majority of flow-capable hardware: Cisco, Juniper, HP/Aruba, Brocade, Fortinet, VMware, and any vendor implementing IPFIX. For devices that don't export flow data at all, PRTG's SNMP Traffic sensor provides interface-level bandwidth monitoring. Note that all flow sensors support IPv4 traffic; IPv6 is not currently supported.

Does PRTG collect NetFlow data from SD-WAN devices?

If an SD-WAN device supports NetFlow or IPFIX export, PRTG can collect and display that network flow data the same way it would for any other network device. You get per-device traffic visibility: which protocols are running, which endpoints are active, how much bandwidth each is using. What PRTG doesn't provide is native SD-WAN topology awareness. It has no built-in understanding of overlay/underlay relationships or path-specific analytics. For VPN traffic passing through SD-WAN devices, the flow data is visible to the extent the device exports it.

How does PRTG handle devices that don't export flow data?

For network devices that don't support NetFlow, IPFIX, sFlow, or jFlow v5, PRTG uses SNMP Traffic monitoring to collect interface-level data. This gives you total traffic in/out, error rates, and packet counts per interface. It's less granular than flow data. You won't get a per-IP or per-protocol breakdown. But it means every device in your environment has some level of traffic visibility. Most environments have a mix, and PRTG handles both within the same network monitoring setup.

Can flow data in PRTG be used for capacity planning?

Yes. PRTG stores all flow sensor metrics historically and graphs them per channel. This means you can look at bandwidth usage trends over time for any interface, see which traffic categories are growing, and identify links that are approaching their limits before they actually hit them. The historical data gives you the context to make informed decisions about upgrades, traffic shaping, or rerouting, rather than reacting after the fact when the damage is already visible.

How does PRTG compare to open-source NetFlow collectors?

Open-source NetFlow collection tools can work well, but they typically require you to set up and integrate separate components for collection, storage, and visualization. Maintaining that stack takes ongoing effort. PRTG covers all three in one installation, without requiring scripting or pipeline work to get usable data. It also integrates your flow monitoring with everything else PRTG monitors in a single interface: servers, applications, network devices. If you're already running PRTG, adding NetFlow collection doesn't require a separate deployment. For teams that want a dedicated, standalone flow analysis platform, open-source tools like ntopng or nfdump are worth evaluating; PRTG's strength is breadth of coverage in a single, maintained tool.

What is a sensor in PRTG?

A sensor in PRTG is the individual monitoring unit that checks one specific aspect of a device or service. For NetFlow monitoring, each sensor corresponds to one interface on one device, collecting and displaying the flow data for that interface as a set of channels (Top Talkers, Top Connections, Top Protocols, and any custom-defined categories). PRTG licensing is based on the number of sensors, and flow sensors count the same as any other sensor type. One sensor per monitored interface.