SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-12 11:12:00 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Implement sFlow/NetFlow collection for reporting usage across the network #1355

New Issue
Open
opened 2025-11-20 05:28:55 -05:00 by saavagebueno · 3 comments
saavagebueno commented 2025-11-20 05:28:55 -05:00
Owner
Copy Link

Originally created by @JonTheNiceGuy on GitHub (Oct 22, 2024).

Is your feature request related to a problem? Please describe.
As the administrator of my self-hosted NetBird environment, I am unable to determine whether traffic flows are entering and exiting the mesh without performing packet captures at the interfaces of all the relevant nodes in the cluster. Storing this data off-node allows for security audits related to ephemeral nodes.

Describe the solution you'd like
It would be great if you could give the administrator the options of either using nothing (turning the feature off), or using the standard protocol of sFlow or NetFlow v9 aggregated at the dashboard/api (e.g. a new container running adjacent to the management/api container), by pointing sFlow/NetFlow v9 from cluster members to specific endpoints in the netbird up configuration (e.g. netbird up --flow 192.0.2.1:12345 or netbird up --flow sflow.example.org:12345), or perhaps introducing a new option along the same lines as the DNS configuration option pushed to the client.

If this is aggregated at a management service, then a simple query tool should be implemented, allowing source and destination addresses and ports to be filtered in a time window.

Describe alternatives you've considered
Deploying an sFlow/NetFlow collector on each node as part of the deployment, however, this does not allow for mobile clients to be supported in this way.

Additional context
May be useful for implementing the netflow format: netsampler/goflow2, cloudflare/goflow

Originally created by @JonTheNiceGuy on GitHub (Oct 22, 2024). **Is your feature request related to a problem? Please describe.** As the administrator of my self-hosted NetBird environment, I am unable to determine whether traffic flows are entering and exiting the mesh without performing packet captures at the interfaces of all the relevant nodes in the cluster. Storing this data off-node allows for security audits related to ephemeral nodes. **Describe the solution you'd like** It would be great if you could give the administrator the options of either using nothing (turning the feature off), or using the standard protocol of sFlow or NetFlow v9 aggregated at the dashboard/api (e.g. a new container running adjacent to the management/api container), by pointing sFlow/NetFlow v9 from cluster members to specific endpoints in the `netbird up` configuration (e.g. `netbird up --flow 192.0.2.1:12345` or `netbird up --flow sflow.example.org:12345`), or perhaps introducing a new option along the same lines as the DNS configuration option pushed to the client. If this is aggregated at a management service, then a simple query tool should be implemented, allowing source and destination addresses and ports to be filtered in a time window. **Describe alternatives you've considered** Deploying an sFlow/NetFlow collector on each node as part of the deployment, however, this does not allow for mobile clients to be supported in this way. **Additional context** May be useful for implementing the netflow format: [netsampler/goflow2](https://github.com/netsampler/goflow2), [cloudflare/goflow](https://github.com/cloudflare/goflow)
saavagebueno added the serverfeature-request labels 2025-11-20 05:28:55 -05:00
saavagebueno commented 2025-11-20 05:28:56 -05:00
Author
Owner
Copy Link

@Blackclaws commented on GitHub (May 5, 2025):

Given that the cloud version supports this already I'm not sure if this is something that they would wanted to add to the self-hosted version as they haven't already done so.

Even then it should be possible to retrofit this as the clients already support it:

https://github.com/netbirdio/netbird/blob/main/management/server/grpcserver.go#L629

This is where you also need to pass a FlowConfig back to the client. Which if I understand the code correctly enables the network flow reporting on the peer side.

This is what is done to the events:

https://github.com/netbirdio/netbird/blob/main/client/internal/netflow/manager.go#L235

And they are using this grpc client to push the events:

https://github.com/netbirdio/netbird/blob/main/flow/client/client.go

So essentially what is done here is that if you modify the server to send a flow config down to the client the client will automatically send their netflow events to a grpc server authenticated with the payload/signature that is passed with the config.

You now need to implement the grpc server that consumes the netflow events.

@mlsmaycon As you are the one that seems to be all over the netflow implementation according to git blame I'm wondering whether you could answer whether a barebones implementation for a companion service for the self-hosted version would be accepted as a pull request so that this functionality can be available to those as well.

@Blackclaws commented on GitHub (May 5, 2025): Given that the cloud version supports this already I'm not sure if this is something that they would wanted to add to the self-hosted version as they haven't already done so. Even then it should be possible to retrofit this as the clients already support it: https://github.com/netbirdio/netbird/blob/main/management/server/grpcserver.go#L629 This is where you also need to pass a FlowConfig back to the client. Which if I understand the code correctly enables the network flow reporting on the peer side. This is what is done to the events: https://github.com/netbirdio/netbird/blob/main/client/internal/netflow/manager.go#L235 And they are using this grpc client to push the events: https://github.com/netbirdio/netbird/blob/main/flow/client/client.go So essentially what is done here is that if you modify the server to send a flow config down to the client the client will automatically send their netflow events to a grpc server authenticated with the payload/signature that is passed with the config. You now need to implement the grpc server that _consumes_ the netflow events. @mlsmaycon As you are the one that seems to be all over the netflow implementation according to git blame I'm wondering whether you could answer whether a barebones implementation for a companion service for the self-hosted version would be accepted as a pull request so that this functionality can be available to those as well.
saavagebueno commented 2025-11-20 05:28:56 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Jun 3, 2025):

This is a feature intended to be cloud-only for now.

Traffic events are available in our self-hosted licensed version for organizations with more than 200 users.

If you are interested, please book a call by accessing the page https://netbird.io/demo?form=enterprise and booking a call.

@nazarewk commented on GitHub (Jun 3, 2025): This is a feature intended to be cloud-only for now. Traffic events are available in our self-hosted licensed version for organizations with more than 200 users. If you are interested, please book a call by accessing the page https://netbird.io/demo?form=enterprise and booking a call.
saavagebueno commented 2025-11-20 05:28:56 -05:00
Author
Owner
Copy Link

@ValarMarkhulis commented on GitHub (Oct 6, 2025):

I have taken the comments/idea by @Blackclaws, and implemented a POC service, which will start a GRPC server that will consume network traffic events from the Netbird peers and put them into a postgres database with minimal processing.

To instruct the Netbird peers to send the network traffic events to the POC service, I have to make a small modification to the management component through the management-integration-codebase, which basically implements the "cloud-only" feature of enabling "Network traffic event logging" on Netbird peers.

As the todo list shows, I still need to do some work on the processing and aggregation of flow events before the data stored in the database is useful for auditing purposes.

@ValarMarkhulis commented on GitHub (Oct 6, 2025): I have taken the comments/idea by @Blackclaws, and implemented a [POC service](https://github.com/ValarMarkhulis/poc-netbird-traffic-event-logging), which will start a GRPC server that will consume network traffic events from the Netbird peers and put them into a postgres database with minimal processing. To instruct the Netbird peers to send the network traffic events to the POC service, I have to make a small modification to the management component through the [management-integration-codebase](https://github.com/ValarMarkhulis/management-integrations-flow-enabled), which basically implements the "cloud-only" feature of enabling "Network traffic event logging" on Netbird peers. As the todo list shows, I still need to do some work on the processing and aggregation of flow events before the data stored in the database is useful for auditing purposes.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label feature-request server
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1355
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?