> ## Documentation Index
> Fetch the complete documentation index at: https://otel.fyi/llms.txt
> Use this file to discover all available pages before exploring further.

# Netflow

> OpenTelemetry receiver for Netflow

# Netflow Receiver

![Status](https://img.shields.io/badge/status-alpha-red)

**Available in:** `contrib`

**Maintainers:** [@evan-bradley](https://github.com/evan-bradley), [@dlopes7](https://github.com/dlopes7)

**Source:** [opentelemetry-collector-contrib](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/netflowreceiver)

## Supported Telemetry

![Logs](https://img.shields.io/badge/logs-alpha-blue)

## Overview

This receiver gives OpenTelemetry users the capability of monitoring network traffic, and answer questions like:

* Which protocols are passing through the network?
* Which servers and clients are producing the highest amount of traffic?
* What ports are involved in these network calls?
* How many bytes and packets are being sent and received?

## Getting started

By default the receiver will listen for ipfix and netflow on port `2055`. The receiver can be configured to listen on different ports and protocols.

Example configuration:

```yaml theme={null}
receivers:
  netflow:
    scheme: netflow
    port: 2055
    sockets: 16
    workers: 32
  netflow/sflow:
    scheme: sflow
    port: 6343
    sockets: 16
    workers: 32
  netflow/raw:
    scheme: netflow
    port: 2055
    sockets: 16
    workers: 32
    send_raw: true

exporters:
  debug:
    verbosity: detailed

service:
  pipelines:
    logs:
      receivers: [netflow, netflow/sflow]
      exporters: [debug]
  telemetry:
    logs:
      level: debug
```

We recommend using `sending_queue::batch` option to reduce the number of log requests being sent by the exporter. The batch option will batch log records together and send them in a single request to the exporter.

You would then configure your network devices to send netflow, sflow, or ipfix data to the Collector on the specified ports.

## Configuration

| Field       | Description                                                                      | Examples           | Default   |
| ----------- | -------------------------------------------------------------------------------- | ------------------ | --------- |
| scheme      | The type of flow data that to receive                                            | `sflow`, `netflow` | `netflow` |
| hostname    | The hostname or IP address to bind to                                            | `localhost`        | `0.0.0.0` |
| port        | The port to bind to                                                              | `2055` or `6343`   | `2055`    |
| sockets     | The number of sockets to use                                                     | 1                  | 1         |
| workers     | The number of workers used to decode incoming flow messages                      | 2                  | 2         |
| queue\_size | The size of the incoming netflow packets queue, it will always be at least 1000. | 5000               | 1000      |
| send\_raw   | Whether to send raw flow messages instead of parsing them                        | `true`, `false`    | `false`   |

When `send_raw` is set to `true`, the receiver will:

* Skip parsing the netflow/sflow messages
* Send the raw message as the log body

## Data format

The netflow data is standardized for the different schemas and is converted to OpenTelemetry log records following the [semantic conventions](https://opentelemetry.io/docs/specs/semconv/general/attributes/#server-client-and-shared-network-attributes)

The log record will have the following attributes (with examples):

* **source.address**: Str(132.189.238.100)
* **source.port**: Int(1255)
* **destination.address**: Str(241.171.33.110)
* **destination.port**: Int(64744)
* **network.transport**: Str(tcp)
* **network.type**: Str(ipv4)
* **flow\.io.bytes**: Int(853)
* **flow\.io.packets**: Int(83)
* **flow\.type**: Str(netflow\_v5)
* **flow\.sequence\_num**: Int(191)
* **flow\.time\_received**: Int(1736309689918929427)
* **flow\.start**: Int(1736309689830846400)
* **flow\.end**: Int(1736309689871846400)
* **flow\.sampling\_rate**: Int(0)
* **flow\.sampler\_address**: Str(172.28.176.1)
* **flow\.tcp\_flags**: Int(0)

The log record timestamps will be:

* **Observed timestamp**: The time the flow was received.
* **Timestamp**: The flow `start` field.

### Schema support

#### netflow

* Process [Template Records](https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html) if present
* Process Netflow V5, V9, and IPFIX messages
* Extract the attributes documented above
* Mapping of custom fields is not yet supported

#### sflow

* Process [sFlow version 5](https://sflow.org/sflow_version_5.txt) datagrams
* `flow_sample` and `flow_sample_expanded` are supported.
* `counter_sample` and `counter_sample_expanded` are NOT yet supported.
* Mapping of custom fields is not yet supported

## Configuration

### Example Configuration

```yaml theme={null}
netflow/defaults:

netflow/one_listener:
  scheme: netflow
  port: 2055
  sockets: 1
  workers: 1

netflow/invalid_schema:
  scheme: invalid

netflow/invalid_port:
  scheme: netflow
  sockets: 1
  workers: 1
  port: 0

netflow/zero_sockets:
  scheme: netflow
  port: 2055
  sockets: 0
  workers: 1

netflow/zero_workers:
  scheme: netflow
  port: 2055
  sockets: 1
  workers: 0

netflow/zero_queue:
  scheme: netflow
  port: 2055
  sockets: 1
  workers: 1
  queue_size: 0

netflow/sflow:
  scheme: sflow
  port: 6343
  sockets: 1
  workers: 1
  queue_size: 0

netflow/raw_logs:
  scheme: netflow
  port: 2055
  sockets: 1
  workers: 1
  queue_size: 0
  send_raw: true
```

***

*Last generated: 2026-07-06*