GoFlow2 on Ubuntu 24.04

Overview

GoFlow2 is an open source network flow collector written in Go. Routers, switches, firewalls and hypervisors can export a summary of every conversation crossing them, but they each speak a different dialect: NetFlow version 5, NetFlow version 9, IPFIX or sFlow. GoFlow2 listens for all of them at once, decodes the templates and samples, and emits every record in one common schema so that everything downstream sees the same fields regardless of which vendor sent it. Records come out as newline delimited JSON or as protocol buffers, written to a file for a log shipper to pick up or published straight onto a Kafka topic for a streaming pipeline. It is deliberately the ingest stage and nothing more: storage, aggregation, enrichment and graphing are left to the tools you already run, which is what lets it stay fast enough to sit in front of a busy network. Prometheus metrics cover received packets, decoded samples, decoding errors and drops, so the collector itself is observable.

Common uses

• Collect NetFlow, IPFIX and sFlow from mixed vendor network hardware into one consistent schema
• Feed a flow analytics pipeline by streaming decoded records to Kafka or a log shipper
• Investigate traffic patterns, top talkers and capacity trends from raw per conversation records