Testing NetFlow export
configurations

NetFlow Tester simply dumps the data of all NetFlow packets that a computer receives from a Cisco router –
useful when debugging bandwidth monitoring configurations based on the NetFlow protocol.
Available for NetFlow v5, v9, and IPFIX.

Free Download
Netflow Testers 5 & 9 (incl. IPFIX) (2.5 MB)

Our NetFlow Testers are small programs that simply dump the data of all NetFlow packets
that a computer receives from a Cisco router. This can be useful when debugging bandwidth
monitoring configurations based on Cisco's NetFlow protocol (v5, v9, and IPFIX).

Instructions

First the NetFlow protocol must be enabled and configured on the router. The router must be given the IP address of the computer running NetFlow tester so that the UDP data packets with NetFlow data are sent to this computer.

Download the ZIP file below and start
- Netflow5Tester.exe for testing NetFlow version 5
- NF9Test.exe for testing NetFlow version 9 and IPFIX
Enter the IP and port number that you have configured as NetFlow packet target in your Cisco Router
Usually selecting "Any IP" should work, in some cases the IP must be explicitly selected
Click on "Start"
You should now see a line in the logfile for each packet the computer receives
Each line shows the time, NetFlow version, number of flows and the IP of a packet (Note: PRTG Network Monitor supports NetFlow v5, v9, and IPFIX)

NetFlow5Tester only: Enable "Show Flow Data instead of packet data" to also show the corresponding flow data
If you do not see any activity then the system does not receive any NetFlow data (e.g. due to misconfiguration of the router or a firewall blocking the packets, etc.)

NetFlow5Tester supports two modes

For NetFlow5Tester, it is important to distinguish between the actual NetFlow v5 packets (the UDP packets sent from the router to PRTG that contain the NetFlow data) and the "flows" (the information inside the UDP packets which shows the data passing through the router).

"Show Flow Data Instead Of Packet Data" Enabled

Now the information of the flow data inside the UDP packet is displayed. Note: There can be several flow data sets in one NetFlow v5 packet!

time: time netflow packet received
start: flow start
end: flow end
source: flow source (this is not the source of the netflow packet!)
destination: flow destination
size: flow size

"Show Flow Data Instead of Packet Data" Disabled

In this mode NetFlow5Tester lists this information about the UDP packets:

time: time UDP packet was received
version: NetFlow version
count: number of flows in the packet
peer: remote address the NetFlow packet is received from