On pfSense/OPNsense: Services > NetFlow > Enable + set collector IP. On Ubiquiti UniFi: System > Advanced > NetFlow Export (IP + Port 2055). Before you build a whole stack, point your router’s NetFlow export to a laptop running ntopng in a Docker container :
ElastiFlow is an open-source template that turns Elasticsearch into a NetFlow collector. You bring the servers, it brings the network analytics. free netflow monitor
flow monitor MY_MONITOR record netflow ipv4 original-input exporter MY_EXPORTER On pfSense/OPNsense: Services > NetFlow > Enable +
The community edition caps at 1 million active flows . That’s fine for branch offices or labs, but not a core data center. 3. ELK Stack (Elasticsearch, Logstash, Kibana) + ElastiFlow Best for: DIY warriors who want unlimited scalability. You bring the servers, it brings the network analytics
You don’t need a six-figure budget to see what’s eating your bandwidth. If you have a router or switch that exports NetFlow, IPFIX, sFlow, or jFlow, you’re already sitting on a goldmine of traffic data. The only missing piece is a free NetFlow monitor to collect and analyze it.