goflow2 VS goflow

I use goflow2 to do something like this. I don't specifically use syslog itself for this, but mtail to generate the metrics.

I've been using this one: https://github.com/netsampler/goflow2

Take a look at goflow2 which is based on Cloudflare's flow analysis pipeline.

I'm not particularly familiar with netflow formats, but this collector emits Prometheus metrics.

GoFlow2 is a high-performance sFlow/IPFIX/NetFlow collector that gathers network information and serializes it in a common format. This fork of CloudFlare's GoFlow provides horizontal scalability, consistent format and the ability to work with raw samples and build aggregation and custom enrichment. Our thanks for this suggestion goes to SuperQue.

You want something like goflow2.

There's goflow2, which is a fork of CloudFlare's goflow netflow collector.

I'd suggest looking at goflow2 before you write something new.

I personally use goflow2, but my needs are pretty simple.

I would greatly appreciate insights and recommendations from those who have experience in this area. Additionally, I'm interested in hearing your opinions on the best tool for this task: nProbe or goflow? Your rationale behind your recommendation would be invaluable.

All in one platform would be preferred, but Docker could sway me to something else. Meaning, I don't want to install a bunch of puzzle pieces to get up and running. GoFlow would be an example here.

Cloudflare goflow / flow-pipeline

For example, for a lot of IDS work, you want to capture netflows if you can. This is something you could do with goflow. Then you can use whatever SIEM/flow analysis tools to figure out what is touching each network location.