FlowScope: the flows, not just the counters
A from-scratch flow collector we point MikroTik exports at: who is talking to whom, through which NAT, named by what the network itself says about its devices.
Why
Interface counters say how much. They do not say who, to where, or whether it was in the clear. We wanted a collector we understood end to end, that could run on a laptop next to a router and later on a server for a whole fleet.
What it does
A template-aware decoder for v9 and IPFIX with a bounded template cache, so a spoofed export cannot grow memory without limit. MikroTik exports a flow on each interface it crosses, so one NAT'd session appears twice; the NAT fields in the template let the collector pair them exactly. Devices are named from what the network already knows: the router's DHCP leases and ARP table over read-only SSH, passive DNS and mDNS answers seen in the stream, DHCP hostnames, TLS server names, reverse DNS, and the vendor from the MAC. Names are scoped per site because private ranges repeat.
A security pass flags exposed management ports, cleartext protocols, scan patterns, beaconing and unusual outbound volume. On a live network it caught cleartext Telnet within minutes. A packet-stream mode scans for credentials in the clear; the dashboard shows findings redacted and the full detail goes to a file only the security owner can read.
Where it is going
Multi-site collection with one collector per site and a central view, and the same naming layer reused by the monitoring tools above.
Sound familiar?
Tell us which part. A first look is usually read-only, and you get the write-up either way.
Start a conversation →