Receives sFlow and NetFlow, normalizes sampling, and forwards everything to a collector.
345
A proxy that sits between your network devices and your flow collector, normalizing sampling rates across sFlow v5, NetFlow v5/v9, and IPFIX — so your collector always receives consistent, correct data regardless of how badly the source device exports it.
1. Create your .env file
# Required: downstream collector IP
FORWARD_IP=192.168.1.10
# Sampling rate stamped on all outgoing flows
FORWARD_RATE=100
# sFlow listen/forward ports
SFLOW_PORT=6343
SFLOW_FORWARD_PORT=6343
# NetFlow / IPFIX listen/forward ports
NETFLOW_LISTEN_PORT=2055
NETFLOW_FORWARD_PORT=2055
# Assumed rate for devices that send no embedded sampling rate
DEFAULT_SAMPLING_RATE=512
# Optional: per-device rate overrides (comma-separated ip:rate pairs)
# DEVICE_RATES=192.168.1.1:1000,10.0.0.5:512
# Optional: preserve original device source IP on forwarded UDP packets
# Requires CAP_NET_ADMIN (see docker-compose.yml)
# SPOOF_UDP_SOURCE=false
2. Run with Docker Compose
services:
flow-normalizer:
image: yourname/flow-normalizer:latest
env_file:
- .env
ports:
- "${SFLOW_PORT:-6343}:6343/udp"
- "${SFLOW_PORT:-6343}:6343/tcp"
- "${NETFLOW_LISTEN_PORT:-2055}:2055/udp"
- "${NETFLOW_LISTEN_PORT:-2055}:2055/tcp"
# Uncomment if using SPOOF_UDP_SOURCE=true
# cap_add:
# - NET_ADMIN
restart: unless-stopped
docker compose up -d
Point your network devices at this container instead of your collector. The normalizer rewrites every flow sample to use FORWARD_RATE, adjusting packet and byte counts to keep traffic volumes accurate, then forwards to FORWARD_IP.
| Device rate vs FORWARD_RATE | What happens |
|---|---|
| Device rate is higher | Counts scaled up |
| Device rate matches | Passed through unchanged |
| Device rate is lower | Samples randomly dropped |
NetFlow v5 is automatically converted to v9 on output. Counter samples are never modified.
By default the collector sees this container's IP as the flow exporter. Set SPOOF_UDP_SOURCE=true (with CAP_NET_ADMIN) to have forwarded UDP packets appear to originate from the actual device — useful if your collector tracks exporters by IP.
For full documentation, source code, and protocol details see the GitHub repository.
Content type
Image
Digest
sha256:5a67a71f9…
Size
43.3 MB
Last updated
5 months ago
docker pull loveskylark/flow-normalizer