How do I install the Ipfix Receiver skill?

Run npx skillmds@latest add gabrielmoreira/ipfix-receiver in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Ipfix Receiver skill do?

Receive and query IPFIX and NetFlow flow records from network devices via UDP. It is listed under Coding & Dev Tools on SkillMD.

Is Ipfix Receiver safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ipfix Receiver?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ipfix Receiver free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Ipfix Receiver?

gabrielmoreira (@gabrielmoreira) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ipfix Receiver by gabrielmoreira — Agent Skill

Name: Ipfix Receiver
Rating: 4.2 (5 reviews)
Author: gabrielmoreira

File contents

IPFIX/NetFlow Receiver Skill

Receive and query IPFIX and NetFlow flow records from network devices via UDP.

Skill ID

ipfix-receiver

Description

This skill enables NetClaw to receive IPFIX (RFC 7011) and NetFlow (v5/v9) flow records from network devices and query the collected data. It provides visibility into network traffic patterns, bandwidth usage, and communication flows.

When to Use

Monitoring network traffic volumes and patterns
Identifying top bandwidth consumers (top talkers)
Investigating network communication between hosts
Analyzing protocol distribution across the network
Troubleshooting connectivity by examining flow data
Capacity planning based on traffic trends

Required MCP Server

ipfix-mcp

Available Tools

Tool	Purpose
`ipfix_start_receiver`	Start listening for flow exports
`ipfix_stop_receiver`	Stop the receiver
`ipfix_get_status`	Check receiver status and statistics
`ipfix_query_flows`	Search flows with filters
`ipfix_get_flow`	Get full details of a specific flow
`ipfix_top_talkers`	Identify highest bandwidth consumers
`ipfix_get_templates`	List cached flow templates

Example Workflows

Start Monitoring

1. Use ipfix_start_receiver with port 2055
2. Configure network devices to export flows to this port
3. Use ipfix_get_status to verify flows are being received

Identify Bandwidth Hogs

1. Use ipfix_top_talkers to see highest traffic sources/destinations
2. Filter by time range if investigating specific period
3. Use ipfix_query_flows with src_ip to drill into specific host

Investigate Host Communication

1. Use ipfix_query_flows with src_ip or dst_ip filter
2. Add protocol filter (6=TCP, 17=UDP) for specific traffic
3. Use min_bytes filter to focus on significant flows

Protocol Analysis

1. Use ipfix_top_talkers to see protocol breakdown
2. Query specific protocols with ipfix_query_flows
3. Analyze port usage patterns

Sample Prompts

"Start the flow receiver on port 2055"
"Show me the top 10 bandwidth consumers"
"Find all TCP flows from 192.168.1.100"
"What's the total traffic volume in the last hour?"
"Show me flows to port 443 with more than 1MB"
"What templates have been received from exporters?"

Configuration

The ipfix-mcp server is configured via environment variables:

IPFIX_PORT: UDP listening port (default: 2055)
IPFIX_BIND_ADDRESS: Bind address (default: 0.0.0.0)
IPFIX_RETENTION_HOURS: Flow retention (default: 24)
IPFIX_RATE_LIMIT: Max flows/second (default: 10000)
IPFIX_DEDUP_WINDOW: Dedup window in seconds (default: 5)

Limitations

In-memory storage only (data lost on restart)
Template caching expires after 30 minutes
Single instance per port
No flow aggregation or rollup
UDP only (no SCTP support)
GAIT logging sampled at 1% to reduce overhead

Related Skills

syslog-receiver - Syslog message collection
snmptrap-receiver - SNMP trap collection
gnmi-telemetry - Streaming telemetry

---name: ipfix-receiverdescription: Receive and query IPFIX and NetFlow flow records from network devices via UDP.license: Apache-2.0--- # IPFIX/NetFlow Receiver Skill Receive and query IPFIX and NetFlow flow records from network devices via UDP. ## Skill ID `ipfix-receiver` ## Description This skill enables NetClaw to receive IPFIX (RFC 7011) and NetFlow (v5/v9) flow records from network devices and query the collected data. It provides visibility into network traffic patterns, bandwidth usage, and communication flows. ## When to Use - Monitoring network traffic volumes and patterns - Identifying top bandwidth consumers (top talkers) - Investigating network communication between hosts - Analyzing protocol distribution across the network - Troubleshooting connectivity by examining flow data - Capacity planning based on traffic trends ## Required MCP Server `ipfix-mcp` ## Available Tools | Tool | Purpose | |------|---------| | `ipfix_start_receiver` | Start listening for flow exports | | `ipfix_stop_receiver` | Stop the receiver | | `ipfix_get_status` | Check receiver status and statistics | | `ipfix_query_flows` | Search flows with filters | | `ipfix_get_flow` | Get full details of a specific flow | | `ipfix_top_talkers` | Identify highest bandwidth consumers | | `ipfix_get_templates` | List cached flow templates | ## Example Workflows ### Start Monitoring ``` 1. Use ipfix_start_receiver with port 2055 2. Configure network devices to export flows to this port 3. Use ipfix_get_status to verify flows are being received ``` ### Identify Bandwidth Hogs ``` 1. Use ipfix_top_talkers to see highest traffic sources/destinations 2. Filter by time range if investigating specific period 3. Use ipfix_query_flows with src_ip to drill into specific host ``` ### Investigate Host Communication ``` 1. Use ipfix_query_flows with src_ip or dst_ip filter 2. Add protocol filter (6=TCP, 17=UDP) for specific traffic 3. Use min_bytes filter to focus on significant flows ``` ### Protocol Analysis ``` 1. Use ipfix_top_talkers to see protocol breakdown 2. Query specific protocols with ipfix_query_flows 3. Analyze port usage patterns ``` ## Sample Prompts - "Start the flow receiver on port 2055" - "Show me the top 10 bandwidth consumers" - "Find all TCP flows from 192.168.1.100" - "What's the total traffic volume in the last hour?" - "Show me flows to port 443 with more than 1MB" - "What templates have been received from exporters?" ## Configuration The ipfix-mcp server is configured via environment variables: - `IPFIX_PORT`: UDP listening port (default: 2055) - `IPFIX_BIND_ADDRESS`: Bind address (default: 0.0.0.0) - `IPFIX_RETENTION_HOURS`: Flow retention (default: 24) - `IPFIX_RATE_LIMIT`: Max flows/second (default: 10000) - `IPFIX_DEDUP_WINDOW`: Dedup window in seconds (default: 5) ## Limitations - In-memory storage only (data lost on restart) - Template caching expires after 30 minutes - Single instance per port - No flow aggregation or rollup - UDP only (no SCTP support) - GAIT logging sampled at 1% to reduce overhead ## Related Skills - `syslog-receiver` - Syslog message collection - `snmptrap-receiver` - SNMP trap collection - `gnmi-telemetry` - Streaming telemetry

Frequently asked questions

Ipfix Receiver