Setting up Akvorado: A NetFlow Analyser for Your IPv6-First Network

Key Takeaways

• Akvorado runs on modest hardware; 8 GB RAM and SSD suffice.
• Docker Compose deploys ClickHouse, Kafka, and Akvorado in minutes.
• SNMP enables readable interface names; required for proper flow labeling.
• NetFlow v9/IPFIX export from router feeds real‑time Sankey visualizations.
• Monitoring only WAN traffic isolates IPv6 ratio and identifies IPv4‑heavy sources.

Pulse Analysis

Deploying a NetFlow collector has traditionally been the domain of large enterprises with dedicated servers and complex pipelines. Akvorado disrupts that model by packaging ClickHouse, Kafka, and a sleek web UI into a Docker‑Compose stack that fits on a low‑cost NUC or even a modest 8 GB RAM box. This accessibility lowers the barrier for home offices and small businesses to gain granular traffic insight, a capability that was once reserved for multi‑petabyte data centers. By leveraging SNMP for interface resolution and supporting both NetFlow v9 and IPFIX, Akvorado delivers enriched flow records that include ASN, geolocation, and protocol type, turning raw packet counts into actionable business intelligence.

For organizations focused on IPv6 transition, the tool’s Sankey visualizations are especially powerful. By slicing traffic on the Ethernet type field, operators can instantly see the proportion of IPv6 versus IPv4 packets and trace the dominant ASNs behind each. In Sweetser’s IPv6‑First case study, this clarity exposed a single BitTorrent‑related ASN as the primary source of IPv4 traffic, prompting a configuration tweak that boosted the network’s IPv6 share by more than 11 percentage points. Such rapid feedback loops are critical for meeting corporate IPv6 adoption targets and for complying with emerging regulatory expectations around network modernization.

Beyond IPv6 monitoring, Akvorado’s open‑source nature and flexible configuration make it a versatile telemetry platform. Users can extend the inlet definitions to ingest additional flow exporters, adjust ClickHouse retention policies to control storage growth, or integrate with existing SIEM solutions for security analytics. The modest storage footprint—just a few gigabytes per month for sampled SOHO traffic—means long‑term trend analysis is feasible without costly infrastructure. As more ISPs and device manufacturers roll out IPv6‑first services, tools like Akvorado will become essential for small‑scale operators seeking to optimize performance, reduce IPv4 reliance, and demonstrate data‑driven network stewardship.