Network Flow Analytics

See what traffic is actually flowing

Device up/down and resource metrics tell you a router is busy. They do not tell you what is moving through it — which subscriber, which interface, which conversation, or which application is filling a backhaul link at 9pm. Flow data answers that, and ISPAgents reads it natively from the equipment an ISP already runs.

This is a technology preview. The IPFIX pipeline is real and decodes live records, but it is early and the proof to date is synthetic — see the boundaries below before planning around it. We would rather be precise about what is shipped than imply production scale that has not been demonstrated.

A native IPFIX pipeline

ISPAgents includes a native IPFIX v10 decoder behind a UDP receiver, with cardinality caps so a noisy exporter cannot blow up memory or storage. Decoded flows are aggregated into rollups at several intervals, drive top-talker views, and are searchable — so an operator can move from "this link is saturated" to "this is the traffic doing it" within one surface.

Dimensions that match how ISPs think

Flows roll up along the dimensions an operator actually reasons about, not just raw five-tuples:

Observer-device analytics scope these rollups to a zone or subscriber context, so flow data lands in the same tenant-scoped world as the rest of the platform rather than floating as a separate raw-flow tool.

Top talkers and flow search

Top-talker views surface the heaviest devices, endpoints, conversations, and interfaces for a chosen window, and flow search lets an operator drill into a specific address, interface, or application across the rollups. Together they turn a saturation alert from "something is wrong on this link" into a concrete, inspectable answer.

Coexist with monitoring, then expand

Flow analytics is meant to sit beside the rest of the platform, not replace it. Run network monitoring and alerts for device health and thresholds, and treat flow as the next layer that explains why a link is loaded once you know it is. On MikroTik-first networks, pair the preview with MikroTik management so the routers exporting flow are also the routers you can monitor, back up, and act on — all on one tenant and device timeline.