// the find
Edgio/vflow
Enterprise Network Flow Collector (IPFIX, sFlow, Netflow)
vFlow is a network flow collector that ingests IPFIX, sFlow v5, and Netflow v5/v9 traffic and fans it out to Kafka, NSQ, or NATS as JSON. Built by Edgio (formerly EdgeCast) for CDN-scale traffic analysis. If you're standing up flow collection for a decent-sized network and want something battle-tested in Go, this is a reasonable starting point.
The protocol coverage is solid — IPFIX, sFlow with L2/L3/L4 raw header decode, Netflow v5 and v9 in one binary. The internal IPFIX template cache uses RPC for replication across collector instances, which is the right call for horizontal scaling without a shared data store. Comes with a built-in stress generator under /stress/hammer, so you can actually load-test your deployment before hitting production. Consumer examples for ClickHouse, Spark, and CLI are included and not just toy stubs.
Last commit was August 2024 and the repo is now under the Edgio org that went bankrupt in 2024 — maintenance trajectory is unclear and there are open issues with no responses. No Netflow v10 (which is IPFIX) deduplication handling if you run multiple collectors — the template cache RPC sync helps but isn't documented well enough to trust for production HA setups. The Kafka producer has two implementations (sarama and segmentio) with no clear guidance on which to prefer or when segmentio wins; that's a foot-gun if you pick the wrong one for your partition strategy. Prometheus metrics are exposed but the grafana dashboard in the docs is a static screenshot with no provisioning JSON.