Most people unfortunately think of Netflow and IPFIX like "that old stuff that ISP or Internet Carrier administrators use to charge for traffic and to predict network growth".

Well, this is for sure the most typical application, like its usage to track DDoS is another one, but if you think smarter, Netflow and IPFIX are the only true standards that give you an almost complete network visibility (except obviously for network packet capture, which - if made on large scale - can be very expensive).

And network visibility today, and even more in the future, is the key to keep complete control over your information workflow.

There are a lot of contexts where you simply cannot use or place firewalls (even though there are many free solutions), maybe for performance reasons, maybe for lack of management skills or for the lack of resources. If your hardware does not support Netflow, but you can setup port mirroring on a switch you are ready to rock !

Most famous Netflow software products still reason in terms of: show me the most used interfaces, make nice charts, top talkers and so on. Fl0wer is probably the first of a new generation of products that use Netflow/IPFIX in a different way. It allows you to do a lot of "classical" things (for now the most useful) but allows you to react and do things when certain traffic patterns are matched.

Think as example about the WannaCry problem that in these days is driving mad a lot of people. Fl0wer cannot for sure solve it but it can help you to track its spreading.

Current WannaCry version had a "kill-switch", but there are already in the wild unstoppable ones. The right combination of malware analysis and traffic pattern matching could be one great way to contribute to stop this infection. Oh, probably even the evaluation version can be used to do that.

Did you think about this or are too busy to postpone innovation ?