man flowbuddy
See what's on your network in a minute.
FlowBuddy turns the flow data your routers, firewalls and switches already export into a live picture of your network: who is talking to whom, over which services, and how much. It is a single small program for Windows, macOS and Linux with the dashboard built in. Nothing to install, no database to set up, and your data never leaves your machine.
Windows · macOS · Linux · FreeBSD
NetFlow v5/v9 · IPFIX · sFlow v5
Flow data, without the setup
Most flow collectors are built for a network operations centre: a server, a database, a week of setup. FlowBuddy is built for the moment you just want to know what's going on.
Up and running in a minute
One file for Windows, macOS or Linux. No installer, no database, no account. Run it and the dashboard opens in your browser.
Every common flow format
NetFlow v5, NetFlow v9, IPFIX and sFlow v5, detected automatically on every port. The standard formats of routers, firewalls and switches from Cisco, Juniper, MikroTik, Arista, HPE/Aruba and many others.
See where traffic goes
A live traffic-flow diagram from sources through services to destinations. Hover to trace one host's traffic, click to filter everything on it.
Live dashboard
Throughput and packet-rate charts, top sources and destinations, services, protocols, conversations, router interfaces and the latest raw flow records.
Hostnames, not just numbers
One click swaps IP addresses for their DNS names across the whole dashboard.
Accurate under sampling
Scales sampled NetFlow, IPFIX and sFlow data back up to real traffic volumes, automatically.
Easy to point devices at
The dashboard shows which address and port to configure. A built-in test mode checks the network path from another machine first.
Private by default
Nothing leaves your machine, and the dashboard only answers on your own computer unless you open it up. Optionally accept data only from devices you list.
Filter and export
Filter by IP address, port, protocol, service or hostname. Export every conversation to CSV.
Follow the traffic
Sources on the left, services in the middle, destinations on the right, with every band as wide as its traffic. Hover over a host to trace exactly where its traffic goes. Click it, and the whole dashboard narrows to that host, its peers, its services and its protocols.
Three steps
Want to look around first? Start it with -demo to see the dashboard with sample traffic.
- Run FlowBuddyThe dashboard opens in your browser.
- Point your device at your machineFlowBuddy shows the address to use and listens on UDP 2055 (NetFlow), 4739 (IPFIX) and 6343 (sFlow).
- Watch your trafficFlows appear as soon as your device starts sending them.
Good for
- Finding out what's using the internet connection right now.
- Checking what a new device, server or application talks to.
- Troubleshooting a slow link or an unexpected traffic spike.
- Verifying a router's NetFlow, IPFIX or sFlow configuration.
- Small offices, home labs, consultants and engineers on site with a laptop.
Technical specifications
| Protocols | NetFlow v5, NetFlow v9, IPFIX (RFC 7011), sFlow v5 |
|---|---|
| Transport | UDP. Default ports 2055, 4739 and 6343; any port accepts any format |
| Addresses | IPv4 and IPv6 |
| Platforms | Windows (x64, ARM64), macOS (Apple Silicon, Intel), Linux (x64, ARM64, ARM), FreeBSD (x64) |
| Size | About 7 MB, a single file with no dependencies |
| Interface | Web dashboard in your own browser, light and dark mode |
| Storage | In memory only; nothing is written to disk |
| Export | CSV of all conversations |
Questions
Do I need to install anything?
No. FlowBuddy is one file. There is no installer, runtime, database or browser plugin.
Does my data go to the cloud?
No. FlowBuddy runs entirely on your machine and doesn't send your flow data anywhere. Hostname lookups use your own DNS server, and only when you turn hostnames on.
Which devices work with it?
Anything that exports NetFlow v5, NetFlow v9, IPFIX or sFlow v5. That includes most business routers, firewalls and managed switches.
Is the history kept after I close it?
Not at the moment: FlowBuddy shows live data and the last hour of throughput. Export to CSV to keep a record.
Can other people look at the dashboard?
By default only your own computer can open it. Start it with -http 0.0.0.0:8787 to make it reachable on your network.
My router is configured but nothing shows up.
Check that your computer's firewall allows the UDP ports in. To test the path without the router, run flowbuddy -send-to <your computer's address> on another machine.
mail rob@robcloud.nl
Questions about FlowBuddy?
Want a demo, pricing or just to know if it fits your setup? Send a message and I'll get back to you.