See top talkers on a branch uplink without a collector VM
When a branch office says the internet is slow, the first question is who is using the uplink. The branch router or firewall can already answer it with NetFlow, IPFIX or sFlow; what is usually missing is a collector on site. A mobile device running MobiObs can be that collector for the afternoon, with no VM to deploy.
MobiObs is available on Google Play for Android. The App Store and desktop versions come later; join the launch list to get one email when they are available.
The approach
- Connect the MobiObs device to the branch LAN or management VLAN and read its address from the Network screen (
10.20.4.9below). - On the device that routes the uplink, export flows to
udp/2055(NetFlow v5/v9 or IPFIX) orudp/6343(sFlow). - Wait for the first template and the first active timeout, then open Flows and sort out who is using the link.
- Remove the exporter before you leave.
This works on a small or medium branch uplink. A mobile device is not sized for a busy core or internet edge router exporting every packet, so on fast links use sampling or export from one interface only.
Set up the exporter
The vendor guides give the exact configuration for each platform:
| Branch device | Export | Guide |
|---|---|---|
| Cisco ISR or Catalyst 8000 | Flexible NetFlow v9 or IPFIX | Cisco |
| FortiGate | NetFlow v9 or sFlow | Fortinet |
| Cisco Meraki MX | NetFlow v9 | Meraki |
| Palo Alto Networks | NetFlow v9 | Palo Alto Networks |
| pfSense or OPNsense | softflowd, Packet Flow Data, or Reporting > NetFlow | pfSense and OPNsense |
| UniFi gateway | NetFlow (IPFIX) | Ubiquiti |
| MikroTik | Traffic Flow v9 or IPFIX | MikroTik |
| Juniper EX or MX | sFlow (EX) or inline IPFIX (MX) | Juniper |
Three exporter settings decide how quickly the picture appears. Set them while you work and put them back afterwards:
- Active timeout: about one minute. A long download is only reported when its active timeout expires. With the common 30-minute default, the biggest user of the link can stay invisible for half an hour.
- Template refresh: about one minute. NetFlow v9 and IPFIX records cannot be decoded until the template arrives. sFlow and NetFlow v5 have no templates.
- Sampling: off on a small link, on for a fast one. MobiObs scales NetFlow v5 and sFlow counts by the reported sampling rate. For sampled v9 and IPFIX, read the numbers as relative shares rather than exact totals.
Where to export from
The interface you export from decides which addresses you see. That matters because of NAT:
- The inside (LAN) interface shows the private address of each client, which is what you need to name a top talker. Export traffic entering this interface to see uploads from clients, and traffic leaving it to see downloads to clients; where the platform only exports one direction, export from both the LAN and WAN interfaces.
- The outside (WAN) interface shows the uplink as the provider sees it, after NAT. Every client appears as the router’s public address, so it answers “how full is the link and with what” but not “who”.
If the branch has several VLANs, export from each inside interface, or from the WAN plus the busiest VLAN. Do not export the same traffic twice from two interfaces in the same direction, or the totals double.
Read the top talkers
The Flows screen charts bytes over time and ranks top talkers, destinations, ports and protocols for the window you select. A practical order of reading:
- Bytes over time. Is the link busy now, or was there a burst? Pick a window that covers the complaint.
- Top talkers. One internal address far above the rest is the usual answer: a backup, a cloud sync client, an operating system update or a camera uploading video.
- Destinations and ports for that talker. Select the talker to open its flow records, filtered to that address. Port 443 to a storage or update service points to sync or updates; a single large destination at night points to a backup that ran late.
- Protocols. A large share of UDP to many destinations can be a video call service, or a sign of something worse.
Overview shows the flow rate next to the syslog rate, so if you also send the router’s logs, a WAN flap or a VPN renegotiation appears on the same timeline as the traffic change.
Verify it works
- Sources, and the exporter list on the Flows screen, show the router or firewall within seconds of the first packet, with the kind of data and the last-seen time. If it does not appear, the export is not reaching the device.
- Flows shows data once the template has arrived (for v9 and IPFIX) and the first flows have timed out. Start a large download on a test client; it should appear among the top talkers within about one active timeout.
- Compare the total with the router’s own interface counters. On an unsampled export they should be close.
Troubleshooting
- The exporter appears in Sources but Flows stays empty. NetFlow v9 or IPFIX is waiting for a template. Lower the template refresh, or restart the export.
- Every talker is the router’s public address. You are exporting from the WAN side after NAT; export from the inside interface.
- The biggest user is missing. The active timeout is still at its default, so long flows have not been exported yet.
- Totals are double the interface counters. The same traffic is exported from two interfaces in the same direction.
- Nothing arrives. Check the destination port (2055 or 6343), the path from the router’s source interface to the device, and client isolation on Wi-Fi.
The Free tier keeps one hour and 50,000 flow rows, which is enough to catch a problem while it is happening. Pro makes retention configurable and adds export; see pricing.