SolarWinds has spent decades refining this tool. The current version (part of the Orion platform) offers a feature set that caters to both small IT teams and large enterprises.
| Area | Recommendation | |------|----------------| | Sampling rate | Use 1:1 (full flow) for security; 1:512 for very high‑throughput core routers. | | Retention | Keep raw flows for 7–14 days; aggregated hourly flows for 1 year. | | Storage isolation | Place Flow DB on separate physical disks from Orion DB and OS. | | Polling interval | Keep SNMP polling at 5–9 minutes; flow expiry at 15 minutes default. | | Security | Restrict UDP 2055 to known exporters; run NFA web console over HTTPS. | solarwinds netflow analyzer
The NetFlow Analyzer service runs on a Windows Server (or VM). It listens on UDP ports (usually 2055, 6343 for sFlow, 4739 for IPFIX). The collector aggregates the exported packets, strips them apart, and writes them into a SQL database. SolarWinds has spent decades refining this tool