NetFlow / IPFIX Analyzer

Collect and decode NetFlow v5/v9 and IPFIX records via UDP socket listener. Real-time top-talker analysis, protocol distribution, flow entropy anomaly detection, and DDoS pattern recognition.

cisco-ios

cisco-nxos

juniper

Open in Generator Open in Platform

You're viewing a preview

The full script, parameters, and execution console are available with a free account.

Already have access? Sign in →

Capabilities

NetFlow
IPFIX
UDP socket
Flow decode
Entropy
UDP socket listener

Required inputs

Parameters the script accepts. Defaults shown; some are vendor- or context-gated.

Parameter	Type	Default	Notes
Top N Talkers top_n	number	10	—
Window (minutes) window_min	number	15	—

Hint 1 — Name your vendors and OS versions

Mention the exact platforms you run (cisco-ios, cisco-nxos, juniper) so the generated analysis logic uses the right CLI/NETCONF syntax.

Hint 2 — State your real thresholds

Provide concrete values for Top N Talkers, Window (minutes) instead of the defaults — they shape what counts as a fault.

Hint 3 — Prioritize the checks you need

This tool can netFlow and iPFIX. Ask for the subset relevant to your incident to keep output focused.

Hint 4 — Describe your inventory format

Tell the assistant whether your device list is CSV, YAML, or JSON and which columns it has, so parsing matches your data.

Sample inventory schema

Authoritative shape of the device/policy data this script consumes.

No bundled inventory sample. The script accepts standard device lists (CSV/YAML) with hostname, mgmt IP, vendor, and credentials.

Expected output

Reference terminal output the script should produce — used as a stylistic and structural target.

terminal

[INFO] Collected 1.2M flows over 15min window
[INFO] Top talker: 10.20.30.5 → 142 GB (35% of egress)
[WARN] Protocol anomaly: 18% UDP/53 to 1 destination — possible DNS tunneling
[INFO] Top app: HTTPS (62%), QUIC (14%), SSH (3%)
[CRIT] Flow spike: 10.50.0.0/24 → 9.4 Gbps (5x baseline)