# Ingest NetFlow/sFlow from network devices via direct UDP

Netography Fusion collects flow records from network devices, including routers, switches, firewalls, and any other device that can output NetFlow, sFlow, or IPFIX.

This page documents how to directly point your network devices to send NetFlow or sFlow to your Netography Fusion ingest IP and port. This delivers flow records to Fusion via unencrypted UDP packets.

If you want to deliver NetFlow or sFlow from your network devices via a TLS-encrypted reliable API connection to the Netography Fusion SaaS, see: [Ingest NetFlow/sFlow via the NetoFlow Connector](/ingest-network-traffic-logs/netflow-sflow/traffic-source-netoflow.md).

For more details on NetFlow and sFlow and configuration tips, see: [NetFlow and sFlow](/ingest-network-traffic-logs/netflow-sflow/netflow-and-sflow.md).

### Steps to Ingest NetFlow/sFlow via direct UDP <a href="#steps-to-ingest-netflowsflow-via-direct-udp" id="steps-to-ingest-netflowsflow-via-direct-udp"></a>

There are 2 steps involved in this process:

1. Add a new Device traffic source in Fusion.
2. Configure your network devices to export NetFlow or sFlow to your Netography Fusion ingest IP and port.

#### 1. Add a new Device traffic source in Fusion <a href="#id-1-add-a-new-device-traffic-source-in-fusion" id="id-1-add-a-new-device-traffic-source-in-fusion"></a>

To start ingesting directly from a network device, in the Fusion Portal, go to **Settings**, **Traffic Sources**, and click the **Add a Traffic Source** button. Select **Device** from the list of Flow Sources listed on the **Add Traffic Source** page.

![Add flow source from a network device](/files/PeVQzgRIGuMosaByTrht)

Add flow source from a network device

Fill out the Add Device configuration form. The *Device Name*, *Sample Rate*, and *IP Addresses* fields are required. All other fields are optional. The BGP configuration on the second screen is only required if you are using BGP in a response policy to do automated blocking and can usually be omitted.

Note the IP address and port displayed on this page on the right-hand side where it says **Your Ingest IP**. You will need this when configuring your network devices.

#### Write down your Fusion Ingest IP:port <a href="#write-down-your-fusion-ingest-ipport" id="write-down-your-fusion-ingest-ipport"></a>

Now that you have created a device traffic source, you can start sending NetFlow or sFlow to the ingest IP and port for your account. If you did not copy this when adding a device source, the ingest IP:port is available by going to **Settings**, **Overview**, and looking at the **Ingest IP** field on that page.

#### 2. Configure your network devices to send NetFlow to Fusion <a href="#id-2-configure-your-network-devices-to-send-netflow-to-fusion" id="id-2-configure-your-network-devices-to-send-netflow-to-fusion"></a>

You will now configure your network device to send NetFlow to the Ingest IP. Consult your network device documentation for the exact instructions on configuring it to export NetFlow or sFlow.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.fusion.vectra.ai/ingest-network-traffic-logs/netflow-sflow/ingesting-netflow-direct.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.