NetFlow v5, v9 and IPFIX ingestion
A UDP collector handling concurrent flow exports from multiple network devices from different vendors. Robust parsing of all major protocol versions without record loss.
Case StudyCustom4 min read
NetFlow Manager — processing network traffic at GB/s with TimescaleDB
Netigo builds and operates secure network infrastructures for enterprise clients. They needed a custom tool for collecting, storing, and reporting network flow data from IPFIX/NetFlow sensors. We designed and delivered a high-performance platform capable of processing traffic in the GB/s range.
GB/snetwork traffic processedwithout record loss
v5/v9/IPFIXsupported protocolsfull coverage
TimescaleDBbillions of recordsefficient querying
100%custom solutionno licensing fees
01 — Starting point
High-volume real-time data — off-the-shelf solutions fall short
Enterprise network infrastructures generate enormous volumes of flow records every second. Commercial NetFlow collectors are expensive, inflexible, and offer limited custom reporting. The solution needed to receive and store data from multiple protocol versions (NetFlow v5, v9, IPFIX), handle peak traffic without dropping records, and enable efficient queries over time-series data.
Commercial NetFlow collectorshigh licensing costs
Reporting flexibilitylimited or none
Multi-protocol version supportoften incomplete
Performance at GB/s throughputproblematic with SaaS solutions
Challenge
custom high-performance collectorcapable of handling real enterprise network traffic volumes
02 — Solution
Custom NetFlow collector with TimescaleDB for time-series data
We designed and built NetFlow Manager — an application for receiving, parsing, and storing flow data with a powerful backend for analytical queries and reporting.
PostgreSQL + TimescaleDB
Flow records are stored in TimescaleDB — a PostgreSQL extension optimised for time-series data. Automatic chunking and compression ensure performance even over billions of records.
GB/s throughput performance
Architecture designed for processing network traffic in the gigabits-per-second range. An efficient pipeline from UDP packet receipt to data persistence minimises latency and prevents record loss.
Reporting & analytics
A web application for network traffic visualisation — top talkers, protocol statistics, time-series charts, anomaly detection, and report exports.
.NET Backend
A high-performance .NET backend handling both flow data ingestion and processing, and a REST API for the frontend and potential integration with external systems.
03 — Architecture
Solution Architecture
NetFlow Manager receives UDP flow exports from network devices, parses them, and stores them in TimescaleDB (PostgreSQL). The frontend queries the backend via REST API and visualises data in real time. The entire solution is deployed in the client's own infrastructure.
- Network: Network devices (NetFlow v5 / v9 · IPFIX · UDP)
- Ingest: UDP collector (receives flow exports); Flow parser · .NET (v5 / v9 / IPFIX)
- Data: PostgreSQL + TimescaleDB (time series · chunking · compression)
- API: REST API (for the frontend)
- Outputs: React frontend (reports · analytics); Report export (CSV · PDF)
04 — Results
Results
NetFlow v5, v9 and IPFIX support
A unified collector receiving exports from network devices of various vendors regardless of protocol version.
GB/s traffic processing
Architecture designed for real enterprise volumes — a pipeline from UDP ingestion to data persistence without record loss.
TimescaleDB for time-series data
Optimised storage and querying over billions of flow records thanks to automatic chunking and compression.
Traffic reporting & visualisation
Top talker overviews, protocol statistics, time-series charts, and anomaly detection in network traffic.
Custom solution with no licensing fees
Full control over code and data — no dependency on a commercial vendor, fully customisable.
Technologies
- .NET
- PostgreSQL
- TimescaleDB
- NetFlow v5/v9
- IPFIX
- UDP
- React
- Docker
More case studies
All case studiesClinicDent
Multitenant SaaS for dental clinics — from booking to insurance billing
HealthcareSaaSMultitenant
Read moreMagistra a.s.
Data warehouse on Microsoft Fabric for a 200+ pharmacy chain
DataEnterpriseMicrosoft Fabric
Read moreJUST CS spol. s r. o.
Full replacement of an MLM sales network management system in 3 months
EnterpriseSystem replacementAzure
Read moreRelated reading
Deeper technical notes on the topics from this case study.
TimescaleDB vs. InfluxDB vs. ClickHouse: picking a database for time-series data
For the Netigo NetFlow ingestion pipeline we had to pick a database that could process GB/s of network data in real time. A concrete comparison of the three candidates on performance, query language, operations and TCO.
Read articleProcessing GB/s of network traffic in .NET: a zero-drop architecture
For Netigo we process IPFIX/NetFlow flows at GB/s volumes. The key is buffering, backpressure and horizontal scaling — no sync processing. What has to be right so the system doesn't start shedding data under load.
Read articleIPFIX/NetFlow parsing in .NET: binary protocols in production
Binary protocols in .NET at high throughput. For Netigo we parse millions of IPFIX packets daily. How to minimise allocations, what Span<T>/Memory<T> buys you, and where the line sits between "elegant" and "fast".
Read articleA senior architect on every project · About us →