<!--startmeta
custom_edit_url: "https://github.com/netdata/netdata/edit/master/src/crates/netflow-plugin/integrations/ipfix.md"
meta_yaml: "https://github.com/netdata/netdata/edit/master/src/crates/netflow-plugin/metadata.yaml"
sidebar_label: "IPFIX"
learn_status: "Published"
learn_rel_path: "Network Performance Monitoring/Network Flows/Flow Protocols"
keywords: ['ipfix', 'netflow v10', 'flows', 'network flows', 'flow collector', 'rfc 7011']
message: "DO NOT EDIT THIS FILE DIRECTLY, IT IS GENERATED BY THE FLOWS' metadata.yaml FILE"
endmeta-->

<!-- markdownlint-disable-file -->

# IPFIX


<img src="https://netdata.cloud/img/network-wired.svg" width="150"/>


Plugin: netflow-plugin
Module: ipfix

<img src="https://img.shields.io/badge/maintained%20by-Netdata-%2300ab44" />

## Overview

Collect network flow records from IPFIX (NetFlow v10) exporters. IPFIX extends
NetFlow v9 with variable-length fields, vendor-specific information elements,
and template withdrawal. Each record exposes the same core fields as NetFlow plus
any additional IEs the exporter provides.

For full documentation including vendor configuration examples (Cisco, Juniper, Arista),
biflow handling, sampling caveats, and verification steps, see the
[Network Flows Overview](https://github.com/netdata/netdata/blob/master/docs/npm/network-flows/README.md).


The plugin uses the same configurable UDP listener set as NetFlow. IPFIX messages are identified by
version number 10 and decoded using cached templates. Decoded records are enriched and
appended to disk-backed journal tiers.


This integration is supported on all platforms.

This integration runs as a single instance per Netdata Agent.


### Default Behavior

#### Auto-Detection

The stock configuration enables the plugin and listens on the configured UDP ports.

#### Limits

Operational limits are driven by sustained flow records/s, exporter batching, template churn, cardinality, retention, storage speed, and enrichment. On modern hardware with fast storage, plan around 50k-100k sustained flow records/s per well-provisioned agent for the full raw + rollup pipeline, provided the underlying disks can sustain the required journal write activity; use distributed agents for larger deployments.

#### Performance Impact

Disabled until exporters send traffic. Once active, CPU and disk I/O scale with flow-record rate, template volume, and cardinality; size retention and storage from observed flow records/s.

## Setup


### Prerequisites

#### IPFIX-capable exporter

A router, switch, or firewall configured to export IPFIX datagrams to the
Netdata agent's UDP listener.



### Configuration

#### Options

IPFIX shares the same `netflow.yaml` configuration file as NetFlow and sFlow.
Enable IPFIX via the `protocols.ipfix` option.


<details open><summary>Config options</summary>



| Option | Description | Default | Required |
|:-----|:------------|:--------|:---------:|
| listener.listen | UDP listener endpoints for NetFlow/IPFIX and sFlow datagrams. YAML accepts either a scalar endpoint or a list of endpoints; CLI accepts repeated `--netflow-listen` flags or comma-delimited values. | 0.0.0.0:2055, 0.0.0.0:6343 | no |
| protocols.ipfix | Enable IPFIX decoding. | yes | no |
| protocols.sampling_cache_max_entries | Maximum learned NetFlow v9/IPFIX sampling-rate entries across all exporter streams. Must be positive. | 100000 | no |
| protocols.sampling_cache_max_entries_per_stream | Maximum learned sampling-rate entries for one exporter stream. Must be positive; values above the global limit are clamped. | 65536 | no |
| journal.journal_dir | Directory for journal files (relative to NETDATA_CACHE_DIR). | flows | no |
| journal.tiers.&lt;tier&gt;.size_of_journal_files | Per-tier retained-artifact budget for journal data and finalized per-journal facet sidecars. Replace `<tier>` with `raw`, `minute_1`, `minute_5`, or `hour_1`. The protected active journal can temporarily exceed the budget. Set to `null` for time-only retention. | 10GB | no |
| journal.tiers.&lt;tier&gt;.duration_of_journal_files | Per-tier maximum age. Replace `<tier>` with `raw`, `minute_1`, `minute_5`, or `hour_1`. The default `null` disables time-based eviction; set a duration to add an age cap. | null | no |


</details>



#### via File

The configuration file name for this integration is `netflow.yaml`.


You can edit the configuration file using the [`edit-config`](https://github.com/netdata/netdata/blob/master/docs/netdata-agent/configuration/README.md#edit-configuration-files) script from the
Netdata [config directory](https://github.com/netdata/netdata/blob/master/docs/netdata-agent/configuration/README.md#locate-your-config-directory).

```bash
cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
sudo ./edit-config netflow.yaml
```

##### Examples

###### IPFIX collection

Listen for IPFIX records on the common NetFlow/IPFIX port.

```yaml
enabled: true
listener:
  listen: "0.0.0.0:2055"
protocols:
  v5: false
  v7: false
  v9: false
  ipfix: true
  sflow: false

```


### Verifying flow data is arriving and diagnosing failures

See [Troubleshooting](https://github.com/netdata/netdata/blob/master/docs/npm/network-flows/troubleshooting.md) for
the full diagnostic recipe. Use `netflow.input_packets` for UDP arrival,
`netflow.protocol_packets` for v5/v7/v9/IPFIX/sFlow identification, and
`netflow.decoder_exceptions` for parse failures. For v9/IPFIX, watch the
missing-template dimensions on `netflow.flow_sets`; Data Sets arriving before
their templates cannot be decoded. See also
[Validation and Data Quality](https://github.com/netdata/netdata/blob/master/docs/npm/network-flows/validation.md).
