FlowStats is a lightweight, self-hosted NetFlow collector and analyzer. Live traffic dashboards, top talkers, ASN breakdown, flow record search and over-limit alerting - on a single server.
Most networks already export NetFlow but only keep it for data retention. FlowStats turns it into answers.
Data, packet and flow rates split by IPv4/IPv6 and L4 protocol, with zoomable charts from 15 minutes to 7 days.
Top IP addresses by bytes and flows, separately for public, your own and private (NATed) subnets.
See which networks your traffic goes to - Google, Meta, Akamai, your upstreams - by flows and by volume.
Filter raw records by address, port, protocol and NAT fields (with negation), then export to CSV or JSON.
Per-subnet flow/s thresholds catch scans, floods and misbehaving hosts. Notify via Slack, Pushover or Prometheus.
When a host crosses the RTBH limit, FlowStats adds it to a MikroTik address list via the API, with a timeout and full history.
CPU load per core, conntrack entries and interface byte and packet rates from SNMP or Prometheus node exporter.
Statistics are pre-computed and stored in an embedded time-series database. Runs happily on a small VM - SSD/NVMe recommended.
Configure collectors in the web UI or through the HTTP API. HTTPS, basic auth and dark mode built in.
Real screenshots from a running instance. Customer addresses are replaced with documentation ranges.
Point your routers at FlowStats and get dashboards out of the box - no PHP or external database to maintain.
Each collector listens on its own UDP port and receives NetFlow from your routers, switches and firewalls.
Flows are aggregated into protocol, subnet and ASN statistics and stored as time series. Raw records stay searchable.
The built-in web UI shows dashboards, top talkers and router health, and lets you filter raw records on demand.
Over-limit hosts trigger notifications to your monitoring and, if enabled, an automatic RTBH block on your MikroTik.
A single monthly subscription with everything included - and no lock-in when a grant program ends.
One price with everything included. Try it free first - no installation needed.
Dashboards, GeoIP, flow search, alerting and automatic RTBH. No add-ons, no feature tiers.
Start with a free cloud trial and point one exporter at it. Install on your own server when you're ready.
A plain monthly subscription - not a data-retention product whose real price shows up after a grant ends.
Any router, switch or firewall that exports NetFlow - for example MikroTik, Cisco or Juniper. Each collector listens on its own UDP port, so you can separate exporters or sites.
A Debian server - virtual or bare-metal. FlowStats ships as a .deb package and runs as a systemd service. SSD/NVMe storage gives the best experience when searching raw records.
No. FlowStats is self-hosted, so flow data stays on your own server. If you prefer, we can also run a cloud trial for you with no installation on your side.
You set flow/s limits for public, your own and private subnets. Hosts over the limit appear in the Over limit view and can trigger Slack, Pushover or Prometheus notifications. With a separate RTBH limit, offending addresses are added to a MikroTik address list automatically, with a configurable timeout.
Yes. The HTTP API lets you download the running config, upload a new one and reload it - handy for configuration management and backups.
Start a free cloud trial. No installation on your side; we'll help you point your first exporter at it.