Point a router or firewall's flow export at the SmartTile collector and its device page gains a NetFlow view: throughput over time, the applications on the wire, the hosts using it most and the networks they are talking to — named by owner, not just by IP.
nfcapd on port 2055), identified by the device's exporter address.Bandwidth graphs say how much; flows say who and what. When a site's circuit is full, the NetFlow view on the device shows the internal host pulling the most, the service it is using and the provider on the other end — from the flows the edge device already knows how to export. No agent, no tap, no probe on site.
A throughput chart of every flow this exporter reported in the window — 1 h, 3 h or 24 h — built by aggregating the flow files in-stream, so even busy exporters stay fast.
Top services by bytes, with well-known ports named (HTTPS, DNS, RDP…). Ports are read from both directions so downloads count against the service, not an ephemeral return port.
The ten sources sending the most bytes through the exporter. Internal addresses are labelled Local network.
The ten destinations receiving the most bytes, named by network owner from an offline ASN database (IPv4 and IPv6), with reverse DNS as a fallback — no live look-up service involved.
Every query is filtered to this device's exporter address (router ip), so one site's flows never appear on another's page.
The collector port drops every source except exporters on devices with NetFlow ticked. The allow-list re-syncs from the database every 60 s — no manual firewall step.
When an exporter has sent nothing in the window the view says so — sample data is never substituted on a live collector.
Raw flow files are kept on the collector for a limited window (48 h by default) and swept hourly.
| Setting | Value |
|---|---|
| Collector | nfcapd, UDP 2055, IPv4 |
| File rotation | 5 minutes |
| Views | 1 h · 3 h · 24 h (maximum) |
| Raw retention | 48 h default (per-server setting) |
| Plan | NetFlow is a plan feature |
| The question | Without flows | With SmartTile NetFlow |
|---|---|---|
| Is the circuit full? | A utilisation graph, if SNMP is on. | Throughput over the last hour or day from the exporter's own flows. |
| Who is using it? | Walk the office. | Top talkers by bytes; internal hosts marked Local network. |
| On what? | Guess. | Application mix by service port, both directions counted. |
| Talking to whom? | A list of IPs. | Top destinations named by network owner from the ASN database. |
nfdump -s srcip/bytes -n 10top talkersnfdump -s dstip/bytes -n 10top destinationsnfdump -s dstport/bytesapplications (service side)nfdump -s srcport/bytesapplications (download side)router ip <exporter>filter on every querycountry_asn.mmdb lookupowner / ASN for each destinationUDP 2055 accepts only exporters on devices with NetFlow ticked; everything else is dropped. A database error leaves the chain as it was — never opened.
Each request checks the device belongs to the signed-in user's organizations and has NetFlow enabled before a single file is read.
The exporter address is validated as an IP before it is passed to the flow query.
nfcapd runs as an unprivileged user with a read-only system and write access to its flow directory only.
| Objection | Answer |
|---|---|
| “Flows will leak between customers.” | Every query is filtered to the device's own exporter address and checked against the user's organizations. |
| “We don't want another open port.” | The port is allow-listed to your exporters only and re-synced every minute from the devices you enable. |
| “Our firewall can't do NetFlow.” | Meraki and UniFi devices already show their own traffic analytics through the vendor API on the same NetFlow button. |