Flows
Counters tell you how much traffic. Flow records tell you who talked to whom: source and destination, protocol, ports, bytes. When a link fills up, flows answer "what is it?"
VyOS exports NetFlow (version 9 here) for the interfaces you choose to a collector. In this build the syntax is flow-accounting netflow interface …, with active-timeout and inactive-timeout to control how often long flows are reported and how quickly finished ones are. Older guides use flow-accounting interface and netflow timeout …, which this version rejects (is not valid).
On the ops server, nfcapd collects the records into files (a new one each minute) and nfdump reads them. The first records are the SNMP queries from the previous section: UDP from the ops server to port 161. After a 20-packet ping and an SSH attempt, filtering for them shows one ICMP flow of 1680 bytes, exactly 20 × 84, and one TCP flow to port 22.
One lab quirk: the Packets column reads 0, while bytes and flows are correct. This nfdump version (1.7.1, from Debian 12) didn't decode the packet counts in VyOS's NetFlow v9 records. Check your own collector against known traffic, like this ping, before trusting its numbers.
root@ops:~# nfdump -R /var/flows -o line -c 12
Date first seen Duration Proto Src IP Addr:Port Dst IP Addr:Port Packets Bytes Flows
2026-10-17 14:58:03.855 00:00:00.042 UDP 198.51.100.10:40318 -> 198.51.100.1:161 0 2983 1
2026-10-17 14:58:03.908 00:00:00.000 UDP 198.51.100.10:51889 -> 198.51.100.1:161 0 80 1
2026-10-17 14:58:03.900 00:00:00.002 UDP 198.51.100.10:53709 -> 198.51.100.1:161 0 311 1
2026-10-17 14:58:03.904 00:00:00.000 UDP 198.51.100.10:48405 -> 198.51.100.1:161 0 78 1
2026-10-17 14:58:19.468 00:00:00.000 UDP 198.51.100.10:38008 -> 198.51.100.1:161 0 80 1
2026-10-17 14:58:19.460 00:00:00.002 UDP 198.51.100.10:39086 -> 198.51.100.1:161 0 311 1
2026-10-17 14:58:19.455 00:00:00.000 UDP 198.51.100.10:48549 -> 198.51.100.1:161 0 117 1
2026-10-17 14:58:19.465 00:00:00.000 UDP 198.51.100.10:51217 -> 198.51.100.1:161 0 78 1
Summary: total flows: 8, total bytes: 4038, total packets: 0, avg bps: 2069, avg pps: 0, avg bpp: 0
Time window: 2026-10-17 14:37:00 - 2026-10-17 14:58:19
Total flows processed: 8, passed: 8, Blocks skipped: 0, Bytes read: 1468
Sys: 0.0000s User: 0.0018s Wall: 0.0012s flows/second: 6622.1 Runtime: 0.0012s
root@ops:~# nfdump -R /var/flows -o line "proto icmp or port 22"
Date first seen Duration Proto Src IP Addr:Port Dst IP Addr:Port Packets Bytes Flows
2026-10-17 14:58:21.942 00:00:09.635 ICMP 198.51.100.10:0 -> 198.51.100.1:0.0 0 1680 1
2026-10-17 14:58:31.586 00:00:00.359 TCP 198.51.100.10:42276 -> 198.51.100.1:22 0 3561 1
Summary: total flows: 2, total bytes: 5241, total packets: 0, avg bps: 4191, avg pps: 0, avg bpp: 0
Time window: 2026-10-17 14:37:00 - 2026-10-17 14:58:31
Total flows processed: 10, passed: 2, Blocks skipped: 0, Bytes read: 1828
Sys: 0.0019s User: 0.0000s Wall: 0.0014s flows/second: 7111.4 Runtime: 0.0014s- Lines 3–10: The SNMP polls from the previous section.
- Line 11: Packets read 0: this collector didn't decode them. Bytes are right.
- Line 17: 20 pings: 1680 bytes, exactly 20 × 84.
- Line 18: The SSH attempt.