skills.rest
automateyournetwork
automateyournetworkCOMMUNITY
Explore all skills by this author →
Website𝕏@john_capobiancoGitHub

ipfix-receiver

Receive and query IPFIX and NetFlow flow records from network devices over UDP.

650|182|Updated Feb 19, 2026
Search Tags:#traffic analysis#udp#netflow#ipfix#network telemetry#top talkers#flow monitoring
One-click install
npx skills add https://github.com/automateyournetwork/netclaw --skill ipfix-receiver
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ipfix-receiver
Source: https://github.com/automateyournetwork/netclaw/tree/main/workspace/skills/ipfix-receiver
Command: npx skills add https://github.com/automateyournetwork/netclaw --skill ipfix-receiver

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Network engineers lack visibility into actual traffic patterns without deploying dedicated flow collectors. This Skill lets NetClaw receive IPFIX (RFC 7011) and NetFlow (v5/v9) exports from network devices and query the collected flow data to answer questions about bandwidth usage, top talkers, and host communication.

Core Features & Use Cases

  • Flow Collection: Start a UDP receiver on a configurable port (default 2055) to ingest IPFIX and NetFlow exports from routers and switches.
  • Flow Querying: Search collected flows with filters for source/destination IP, protocol, port, and minimum byte counts.
  • Top Talkers Analysis: Identify the highest bandwidth consumers and protocol distribution across the network.
  • Use Case: A user suspects a host is saturating a WAN link. They start the receiver on port 2055, point device flow exports at it, then run top-talkers analysis and drill into the offending host's flows by source IP and protocol.

Quick Start

Start the flow receiver on UDP port 2055 and show me the top 10 bandwidth consumers once flows arrive.

Frequently Asked Questions about ipfix-receiver

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I collect NetFlow or IPFIX data from network devices?▼

Start the flow receiver with ipfix_start_receiver on a UDP port (default 2055), then configure your routers or switches to export NetFlow v5/v9 or IPFIX records to that port. Use ipfix_get_status to confirm flows are arriving.

How do I find the top bandwidth consumers on my network?▼

Use the ipfix_top_talkers tool to list the highest-traffic sources and destinations, optionally filtered by time range. Then drill into a specific host with ipfix_query_flows using a src_ip filter.

Does the receiver support both NetFlow v5/v9 and IPFIX?▼

Yes, the receiver handles NetFlow v5 and v9 as well as IPFIX (RFC 7011) exports over UDP. It caches flow templates from exporters, which you can inspect with ipfix_get_templates.

What are the limitations of in-memory flow collection?▼

Flow data is stored in memory only and is lost on restart, with retention defaulting to 24 hours. There is no flow aggregation or rollup, template caching expires after 30 minutes, and only UDP transport is supported.

Why is my flow receiver not receiving any records?▼

Verify the receiver is running with ipfix_get_status and that devices export to the correct UDP port and bind address. Check that the rate limit (default 10000 flows/second) is not being exceeded and that no other instance is bound to the same port.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

analyzing-network-flow-data-with-netflow

Parse NetFlow v9 and IPFIX records to detect port scanning, exfiltration, and C2 beaconing.

Community
Intermediate
incidentfoxincidentfox
654

metrics-analysis

Analyzes Prometheus/Grafana metrics with PromQL queries to identify latency, error rates, and resource usage.

Official
Intermediate
timeplus-iotimeplus-io
1

cisco-asa-syslog

Parse and categorize Cisco ASA syslog messages by severity and ID.

Official
Advanced
giosuetedeschi-specgiosuetedeschi-spec

Wireshark Network Traffic Analysis

Capture, filter, and examine packets in PCAP files to identify security threats.

Community
Advanced