How to configure NetFlow accounting in Splynx

When it comes to bringing usage data into Splynx, one of the methods that can be applied is NetFlow accounting. NetFlow accounting uses the NetFlow protocol that is universal for many manufacturers of network equipment. Using this protocol is convenient as the router (sensor) transfers packets with usage data information to the server for analysis at the right time. The following topology sample shows how the protocol collects and analyses usage data.

Netflow protocol

Splynx has used the NetFlow protocol for traffic accounting since version 3.1.

Below is the topology sample that depicts the captured flow of how Splynx and NetFlow accounting work.

topology sample

Splynx server is both a NetFlow collector and NetFlow analyser at the same time. When receiving NetFlow packets, these data are instantly analysed, and the exact amount of traffic used by a subscriber is determined.

NetFlow packets are stored on the server. To prevent the unnecessary aggregation of already analysed packets, you can control the storage period and the amount of NetFlow packet data for each router in Splynx, setting them in Config → Networking → NetFlow Accounting → Expire options. Take a real-life look at the location of the Netflow packet data in the Splynx demo.

Netflow packet data


  1. You first need to specify the port on which the server will scan and collect NetFlow packets (udp/9995 by default) and the session timeout.

    NetFlow packets

  2. The next step is to configure the router in the system. In Internet services, specify which router is used.

    configure the router

    Router Dashboard

  3. After configuration, the server will start a process that will collect traffic data on the specified port, divide and analyze it for each router.

In addition, you can configure subnets for tariffs that include services where data usage accounting is ignored.

To set up the subnets, go to Config — Networking — Traffic class. In the tariff settings, specify which subnets will be excluded from the traffic accounting.

Config — Networking


Case 1: Check the daemon state and log data

Splynx uses some scripts from the nfdump package to calculate traffic:

  1. daemon nfcapd scans the port, and the data can be received there. When the interval for data collection ends, the data will be recorded in a file.
  2. After that, the console script ./var/www/splynx/system/scripts/accounting-neflow starts runs the nfdump process with the specific parameters. The script gets a response and converts it into the acceptable format for the Splynx Accounting Processor.

To check if the nfcapd daemon runs, use this script:

ps -aux | grep nfcapd

To check the log:

sudo tail -f /var/log/syslog | grep nfcapd

Case 2: Missing MAC and Session ID values in the customer’s internet statistics

In the customer’s internet session statistics, you can notice that the last two sessions are listed without MAC and Session ID values. This is a common condition due to the limitations in NetFlow v5, which results in such data not being transferred to Splynx.

Read more detailed information about the settings and the use of NetFlow accounting on the example of the Mikrotik router configuration.

1. Documentation

More in Network management

Network management

Simplifying network troubleshooting with Ping and Traceroute features

Explore Splynx 4.2's Ping and Traceroute features, simplifying network troubleshooting and boosting ISP team efficiency.

Network management

Hardware Backup & Change Management in Splynx

Maintaining network stability and reliability is paramount for both ISPs and their valued customers. To address this, Sp...

Network management bandwidth management

Bandwidth management in Splynx

As a local ISP business owner, ensuring efficient bandwidth management is crucial for maintaining customer satisfaction ...

Network management Splynx network management

Streamlining network management: A closer look at Splynx’s capabilities

Efficient network management is essential for ISPs to deliver reliable and high-quality services to their customers. Wit...

Network management Network topology failover server

Overview of RADIUS failover server

One of the methods used to authorize Internet services in Splynx is the RADIUS protocol. More details about the Splynx R...

Network management Below is the topology sample that depicts the captured flow of how Splynx and NetFlow accounting work.

How to configure NetFlow accounting in Splynx

Learn how to configure NetFlow accounting to to bring usage data into Splynx.

Network management Hotspot add-on in Splynx 4.0

Hotspot add-on in Splynx 4.0

The Hotspot add-on was built to help businesses from low-income communities grow and earn more.

Network management How to configure Juniper Radius

Juniper Radius configuration with variables

This article is the second part of the Juniper MX Radius configuration tutorial.

Network management How to configure Radius Juniper MX

How to configure Radius Juniper MX

Juniper Networks is one of the leading vendors producing networking equipment. Together with Cisco, Juniper defines wher...

Network management Mikrotik ipv6 configuration

How to configure Mikrotik IPv6

This blog post describes how to configure the Mikrotik router to act as a PPPoE server with IPv6 enabled.

Find out how Splynx helps ISPs grow

Learn more