Managing Nodes
Nodes represent the servers, routers, or network segments you want Flowtriq to monitor. This guide covers adding nodes, understanding their statuses, editing settings, and day-to-day node management.
Deployment Modes
Flowtriq supports three deployment modes. Click the Deploy dropdown on the Nodes page to choose:
| Mode | Description | Best For |
|---|---|---|
| Agent Node | Install the ftagent on each server. Provides per-packet detection, PCAP capture, and fastest response times. | Individual servers, game servers, web servers, bare metal |
| Flow Source | Receive sFlow, NetFlow v5/v9, or IPFIX from routers. No agent installed on monitored devices. | Network-wide visibility from routers and switches |
| Mirror / SPAN | Monitor full network segments from a SPAN port. Per-IP detection across the entire segment. | Datacenters, colocation, network segments |
Adding an Agent Node
- Go to Nodes in the sidebar and click Deploy → Agent Node.
- Enter the required fields:
- Node Name (must be unique within your workspace)
- Public IP (must be a public IPv4 or IPv6 address; private/reserved IPs like 192.168.x, 10.x, 127.x are rejected)
- Optionally fill in Location, OS, Interface (defaults to
eth0), and Notes. - Click Register Node & Generate API Key.
Installing the Agent
After creating the node, the dashboard shows a one-liner install command that you can copy and run on your server:
This single command installs Python if needed, installs the agent from PyPI, writes the configuration file, and starts the systemd service.
Alternative installation methods (guided CLI, manual install, Docker) are also shown on the post-creation card.
Adding a Flow Source
- Click Deploy → Flow Source.
- Enter a Source Name and the Collector Server IP (the IP of the server running ftagent).
- Select the Protocol (Auto-detect, sFlow v5, NetFlow v5, NetFlow v9, or IPFIX).
- Set the Listen Port (default: 6343).
- Click Create Flow Source.
After creation, configure your router to export flow data to the collector IP and port. Router configuration examples for Juniper and MikroTik are provided inline.
Adding a Mirror/SPAN Source
- Click Deploy → Mirror / SPAN.
- Enter a Source Name and the Monitoring Server IP.
- Specify the SPAN Interface (default:
eth1) and optionally the Monitored Subnets (comma-separated CIDRs). - Click Create Mirror Source.
The dashboard provides a one-liner command to install the agent in mirror mode on your monitoring server.
Node Statuses
| Status | Color | Meaning |
|---|---|---|
| online | Green | Agent is reporting metrics normally. No issues detected. |
| offline | Gray | Agent has stopped sending heartbeats. The server may be down, the agent may have crashed, or a network issue is blocking communication. |
| attack | Red | One or more active incidents are open on this node. Traffic has exceeded the attack detection threshold. |
| elevated | Yellow | Traffic is above baseline but below the attack threshold. The node is in a warning state. |
| unknown | Gray | Node was recently created but has not yet sent its first heartbeat. |
Node List View
The Nodes page displays all active nodes with the following information per row:
- Node name, IP address, and location
- Status badge and agent version
- Current PPS and baseline data (avg PPS, p95 PPS, p99 PPS)
- Last seen timestamp
- Node mode (agent, flow, mirror)
Searching and Filtering
Use the search bar at the top to filter nodes by name, IP address, location, or tags. You can also filter by status using the status filter dropdown (Online, Offline, Attack, Unknown).
Editing Node Settings
Click any node to open its detail page. From there you can edit:
| Setting | Description |
|---|---|
| Name | Display name (must be unique within your workspace) |
| IP Address | The public IP being monitored |
| Location | Free-text datacenter or region label |
| OS | Operating system identifier |
| Interface | Network interface the agent monitors (e.g., eth0, ens18) |
| PPS Threshold | The packets-per-second threshold that triggers detection. Minimum 100. |
| Priority | Production, Staging, or Development. Affects alert urgency. |
| Tags | Comma-separated tags for organization and filtering |
| Notes | Free-text notes visible to your team |
Regenerating an API Key
If you lose a node's API key or need to rotate it for security reasons:
- Go to the Nodes page.
- Find the node and click Regenerate API Key.
- The old key is immediately invalidated. The new key is shown once.
- Update the agent configuration on your server with the new key.
Deleting a Node
To remove a node:
- Go to the node's detail page or find it in the node list.
- Click Delete and confirm.
- The node is soft-deleted (marked inactive). Any active incidents on the node are automatically resolved.
- For agent nodes, the subscription quantity is decremented automatically.
sudo systemctl stop ftagent && sudo systemctl disable ftagent on the server to stop the agent.Node Health Monitoring
Each node's detail page includes:
- Live PPS chart showing real-time traffic volume
- Baseline data including average PPS, P95, P99, and protocol distribution (TCP/UDP/ICMP percentages)
- Agent version currently running
- Last seen timestamp showing when the agent last checked in
- API key last used timestamp
Billing and Limits
- During your free trial, you can deploy up to 25 nodes.
- On an active subscription, each new agent node is automatically billed at your plan rate (prorated).
- Flow sources and mirror sources have separate billing from agent nodes.
FAQ
Can I use a private IP address?
No. Flowtriq requires a public IP address for each node. Private and reserved IPs (192.168.x, 10.x, 127.x, 0.0.0.0) are rejected during node creation.
What happens if I delete a node that is under attack?
All active incidents on that node are automatically resolved with the current timestamp. The node is marked inactive and disappears from the dashboard.
Can I have duplicate node names?
No. Each node name must be unique within your workspace. Attempting to create a duplicate will show an error.