IPFIX/NetFlow Receiver Skill

Receive and query IPFIX and NetFlow flow records from network devices via UDP.

Skill ID

ipfix-receiver

Description

This skill enables NetClaw to receive IPFIX (RFC 7011) and NetFlow (v5/v9) flow records from network devices and query the collected data. It provides visibility into network traffic patterns, bandwidth usage, and communication flows.

When to Use

• Monitoring network traffic volumes and patterns
• Identifying top bandwidth consumers (top talkers)
• Investigating network communication between hosts
• Analyzing protocol distribution across the network
• Troubleshooting connectivity by examining flow data
• Capacity planning based on traffic trends

Required MCP Server

ipfix-mcp

Available Tools

| Tool | Purpose | |------|---------| | ipfix_start_receiver | Start listening for flow exports | | ipfix_stop_receiver | Stop the receiver | | ipfix_get_status | Check receiver status and statistics | | ipfix_query_flows | Search flows with filters | | ipfix_get_flow | Get full details of a specific flow | | ipfix_top_talkers | Identify highest bandwidth consumers | | ipfix_get_templates | List cached flow templates |

Example Workflows

Start Monitoring

1. Use ipfix_start_receiver with port 2055
2. Configure network devices to export flows to this port
3. Use ipfix_get_status to verify flows are being received

Identify Bandwidth Hogs

1. Use ipfix_top_talkers to see highest traffic sources/destinations
2. Filter by time range if investigating specific period
3. Use ipfix_query_flows with src_ip to drill into specific host

Investigate Host Communication

1. Use ipfix_query_flows with src_ip or dst_ip filter
2. Add protocol filter (6=TCP, 17=UDP) for specific traffic
3. Use min_bytes filter to focus on significant flows

Protocol Analysis

1. Use ipfix_top_talkers to see protocol breakdown
2. Query specific protocols with ipfix_query_flows
3. Analyze port usage patterns

Sample Prompts

• "Start the flow receiver on port 2055"
• "Show me the top 10 bandwidth consumers"
• "Find all TCP flows from 192.168.1.100"
• "What's the total traffic volume in the last hour?"
• "Show me flows to port 443 with more than 1MB"
• "What templates have been received from exporters?"

Configuration

The ipfix-mcp server is configured via environment variables:

• IPFIX_PORT: UDP listening port (default: 2055)
• IPFIX_BIND_ADDRESS: Bind address (default: 0.0.0.0)
• IPFIX_RETENTION_HOURS: Flow retention (default: 24)
• IPFIX_RATE_LIMIT: Max flows/second (default: 10000)
• IPFIX_DEDUP_WINDOW: Dedup window in seconds (default: 5)

Limitations

• In-memory storage only (data lost on restart)
• Template caching expires after 30 minutes
• Single instance per port
• No flow aggregation or rollup
• UDP only (no SCTP support)
• GAIT logging sampled at 1% to reduce overhead

Related Skills

• syslog-receiver - Syslog message collection
• snmptrap-receiver - SNMP trap collection
• gnmi-telemetry - Streaming telemetry