--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Data collection and discovery using Netflow # Data collection and discovery using Netflow {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Data collection and discovery using Netflow Service Mapping supports discovery of Configuration Items (CIs) and their connections using data collected via the Netflow protocol, supplementing traditional methods like netstat, ss, and lsof commands. Netflow-based discovery is a traffic-based method that enables enhanced visibility into network flows within your organization. Show full answer Show less ## Key Features * **Netflow Protocol Integration:** Collects detailed flow data from network switches to identify CIs and their communication patterns. * **Two Deployment Modes:** * **Testing Setup:** A semi-automated process where the Netflow Collector is installed on a separate server from the MID Server. Data from the Netflow Collector must be manually copied to the MID Server. * **Standard Operation:** Fully automated data flow with the Netflow Collector co-located on the MID Server's host, enabling seamless data collection and discovery. * **Data Processing Flow:** The Netflow daemon collects data from switches, which the Netflow Collector writes into nfdump output files. The MID Server processes these files, placing processed connection data into the ECC queue. A sensor then transfers this data into the saflowconnection table for Service Mapping to use. * **Discovery Enrichment:** Service Mapping cross-references discovered CIs with TCP connection data in the cmdbtcp and saflowconnection tables. Unique connection data not previously discovered is used to enrich CI maps with additional outbound connection details. ## Practical Benefits for ServiceNow Customers * Enhances the accuracy and completeness of discovered CI relationships by integrating Netflow traffic data. * Supports both manual testing and fully automated deployment models to fit organizational needs and deployment maturity. * Improves network communication visibility, enabling more detailed and reliable service maps. * Enables customers to leverage existing Netflow infrastructure for deeper insights without disrupting standard discovery processes. ## Next Steps To enable Netflow-based discovery, configure your environment according to the desired deployment mode: testing or standard operation. Ensure the Netflow Collector and MID Server are appropriately placed and that data processing workflows are established. This setup will allow Service Mapping to automatically incorporate network flow data into your CMDB, enriching your service maps and improving discovery fidelity. Service Mapping can perform discovery based on data collected using the Netflow protocol. Netflow is a protocol that Service Mapping can use to collect data about CIs and their connections along with Netstat and lsof commands. Using the Netflow protocol for collecting data is one of the traffic-based discovery methods. Other methods deployed by Service Mapping are using netstat and lsof commands and the VPC Flow Logs. For more information, refer to [Traffic-based discovery in Service Mapping](https://www.servicenow.com/docs/Nc~BmgMGFb2e4_PVEPNMaw "Service Mapping can discover and map configuration items (CIs) following their traffic-based connections. This method is referred to as traffic-based mapping and complements pattern-based mapping."). In base systems, which are the default or standard configurations, traffic-based discovery relies solely on TCP-related data collected using the netstat, ss, and lsof commands. Discovery based on Netflow and VPC logs requires additional configuration. You can enrich your traffic-based discovery by configuring Service Mapping to use the Netflow protocol. The component, which receives data in the Netflow format is the Netflow Collector. Its location depends on whether you configure data collection for testing purposes or standard operation: For the test purposes : This setup results in half automated data collection flow, where Service Mapping imports data only if you manually copy it from the Netflow Collector. You place the Netflow Collector on a server inside your organization network. This must be a server different from the server hosting the MID Server. You configure and test this setup as described in [Configure a Netflow data import for testing](https://www.servicenow.com/docs/h6y9~OTy9wQGiEtYY6LwOA "Configure and test Service Mapping discovery process based on data collected using the Netflow protocol."). For standard operation : This setup results in fully automated data collection flow, where all involved components send, collect and analyze data automatically. You place the Netflow Collector on the same server as the MID Server inside your organization network. For instructions, see [Configure data collection using Netflow](https://www.servicenow.com/docs/hr62QykKsESDT_UyaMsJvQ "Enable Service Mapping to perform discovery based on data collected using the Netflow protocol. This setup results in fully automated data collection flow, where all involved components send, collect, and analyze data automatically."). Netflow-based discovery has the following flow: 1. The Netflow daemon runs and receives data from switches communicating with servers in the organization. The Netflow Collector writes received data from the Netflow daemon. 2. The server, hosting the Netflow collector, uses the Netflow nfdump utility to write the data into the nfdump output file. This file summarizes the raw data on all switches used for server communication.Figure 1. Collecting data and writing it into the nfdump output file 3. In testing setups, where the Netflow Collector is located not on the same server as the MID Server, you may need to convert the nfdump into the gzip format. Then you must manually copy the raw data in the nfdump output file onto the MID Server.Figure 2. Copying the nfdump output file onto the MID Server 4. The MID Server processes the raw data in the nfdump output file and places the processed information onto the ECC queue.Figure 3. Analyzing the raw data and placing it at the ECC Queue 5. A sensor retrieves the processes data from the ECC queue and writes it into the Flow Connection \[sa_flow_connection\] table. 6. Whenever Service Mapping checks the ECC queue and receives information on a discovered CI, it checks these tables for any data on outbound connections related to the CI: the cmdb_tcp and sa_flow_connection tables. If these two tables contain unique data that patterns did not discover, Service Mapping enriches the information about the CI connections and adds them to the map. Figure 4. Service Mapping retrieves data from the sa_flow_connection table {#data-collection-netflow-mapping__ol_phq_vhj_wy} **Related topics** *