← Operator library Network Observability

Use Flow Telemetry for Capacity, Abuse and Incident Evidence

Design an ISP flow pipeline with sampling, enrichment, retention and privacy boundaries before building dashboards.

What this note covers

Design an ISP flow pipeline with sampling, enrichment, retention and privacy boundaries before building dashboards.

Flows describe conversations, not subscriber truth

NetFlow or IPFIX summarizes who communicated, when, over which protocol and with how many bytes or packets. It can reveal traffic shifts and attack patterns, but it does not contain payload and may be sampled. Subscriber attribution requires time-aligned address and session records.

Export

Choose observation points, fields, sampling and templates deliberately.

Transport

Protect collectors from loss, spoofing and uncontrolled internet exposure.

Enrichment

Join routes, interfaces and subscriber sessions using synchronized time.

Governance

Limit access, retention and use of metadata.

Place exporters around decisions

Export at edges and aggregation points that answer a question. Duplicated observation can double-count traffic, while asymmetric paths can hide one direction. Label exporter, interface and sampling rate.

Size collector ingestion and storage from measured flow rate. Template churn, NAT, IPv6 and high-cardinality addresses affect capacity.

Build analysis from baselines

Track protocol, destination ASN, interface and customer-cohort distributions over comparable busy hours. Alerts should describe deviation and confidence, not merely a large number.

For CGNAT attribution, flow data alone is insufficient. Preserve legally governed NAT translation and subscriber session records with precise time.

Use evidence proportionately

Flow helps identify top contributors, scan patterns, reflection traffic and capacity trends. Confirm with interface counters, routing and service telemetry before action.

Restrict raw metadata because communication patterns can be sensitive. Publish purpose and retention, and audit analyst access.

Operational caution: Do not claim application identity from ports alone or exact byte totals from sampled exports without stating uncertainty.

Evidence before rollout

Signal Required proof
Observation map Each exporter and interface has a documented purpose.
Loss Collector tracks dropped datagrams, templates and ingest lag.
Time Exporters, RADIUS, NAT and collector clocks align.
Sampling Queries and reports account for the configured rate.
Access Raw flow retention and analyst use are governed.

Put the plan into operation

  1. Question. Choose capacity or incident use cases first.
  2. Place. Select exporters without accidental duplication.
  3. Size. Measure flow rate and retention cost.
  4. Enrich. Join route and subscriber context safely.
  5. Baseline. Learn normal distributions before alerting.
  6. Review. Validate findings and privacy controls.

The decision standard

Flow telemetry is valuable when its observation point, sampling and attribution limits are explicit. It becomes misleading when attractive charts hide missing direction, stale templates or uncertain subscriber mapping.

Research basis: IETF IPFIX architecture; Cisco NetFlow documentation; privacy-by-design principles. Validate implementation details against the releases, contracts, and local regulations governing your network.

Continue with ISPbills

Put this guide into practice