Network Flow Monitoring: An Evaluation of Modern Collector Software#

Yannick Huber (BelWü / University of Stuttgart), with Benjamin Steinert, Lukas Pietzschmann, Gabriel Paradzik, Michael Menth (Tübingen, Ulm)

• Why: Firmly substantiated, quantitative tool evaluation — exactly the kind most teams never have time to do. Benchmarks six actively maintained, self-hostable open-source flow collectors (Akvorado, GoFlow2, IPFIXcol2, nfdump, pmacct, SiLK) for sFlow and IPFIX.
• What: Combines a feature/usability matrix (protocol support, enrichment, anonymization, Kafka/file outputs, telemetry endpoints) with sustainable-throughput benchmarks in a controlled testbed (synthetic generator, 20 flows per packet, 4 CPU cores / 12 GB RAM). Headline numbers: to Kafka, pmacct sustains ~186–209k flows/s, IPFIXcol2 ~375–446k, GoFlow2 ~13–15k (JSON) vs. ~77–86k (protobuf), Akvorado ~510–548k (raw forwarding); to file, nfdump reaches up to ~842k flows/s (IPFIX) and IPFIXcol2 ~680k. Main findings: input format matters (IPFIXcol2 and nfdump do best on IPFIX; SiLK and pmacct lag on sFlow), output serialization is crucial (GoFlow2's JSON path is an order of magnitude slower than protobuf), and message brokers enable horizontal scaling and redundant deployments.
• How: Found the sustainable processing rate by ramping packet rate while verifying flows in equals flows out; also documents production drop-detection tactics (canary flows, indirect CPU/memory/interface monitoring) since most collectors lack adequate telemetry endpoints.
• Where applicable: Results are dimensioned to a specific testbed (4 cores, 20 flows/packet — decapsulation overhead rises with fewer flows per packet) and the authors flag open questions (custom IPFIX fields, resource scaling). The load-testing tool is open-sourced (go-nflow-stresstest on Codeberg), so the benchmark is reproducible. No single winner — the value is the selection/dimensioning guidance.