Ingest every exporter
Accept NetFlow v5/v9, IPFIX, and sFlow from routers, firewalls, and switches, with per-exporter observation domains and sampling awareness.
Network telemetry · flow analytics · engineering preview
See what your network is actually doing.
DarkFlow turns raw NetFlow, IPFIX, and sFlow into an investigable picture of traffic. It normalizes flows from every exporter, corrects for sampling, and enriches the addresses that matter so you can answer "who talked to whom, how much, and should they have."
The flow collector and analytics runtime are implemented; production release qualification is in progress. Plan and validate a deployment with the DarkAPI team before relying on it in production.
COLLECTOR STATUSFLOWS ARRIVING
01 exporter: edge-fw-01 · ipfix
02 sampling: 1:1000 · corrected
03 top talker: 10.0.4.12 → 91.x (flagged)
flow → context label → reputation → evidence
Built for real traffic questions
From packets on the wire to answers you trust.
See who talks to whom
Rank top sources and destinations by bytes and flows, split traffic by direction, and label each address by asset, subnet, or exporter context.
Trust the numbers
Sampling-corrected counters, collector and exporter health with loss detection, and ASN-backed IP reputation on the addresses that matter.
Honest about sampling and collector health.
Flow data lies when you ignore sampling and dropped exporters. DarkFlow tracks per-collector loss, exporter last-seen and status, and separates sampled from unknown-sampling flows, so the byte and flow counts you act on are the ones you can defend.
NetFlow v5/v9, IPFIX, sFlow
Sampling-corrected counters
Per-exporter health & loss
Asset / subnet / exporter labels
ASN & IP reputation
Cursor-paged flow search
Fit DarkFlow into your detection workflow.
Pair flow with logs in DarkAPI, pivot from a suspicious talker to its context and reputation, and surface signals when an exporter goes dark or a host starts behaving unlike itself.
What you get back
- Live flow search with context labels
- Top-talker and direction summaries
- Collector & exporter health signals
Ready to see your traffic clearly?
Talk with us about exporter coverage, sampling, retention, and a safe production rollout.
Get started