Free NetFlow Analyzers and Collectors for Windows: 8 Tools Compared Before You Install

A NetFlow collector listens for flow records that routers, switches and firewalls export, and an analyzer turns those records into top talkers, application breakdowns and trends. The two roles are often bundled, but some tools only collect, and some only decode packets. Knowing which role a product plays prevents wasted trials.

The record formats are standardized. Cisco's NetFlow version 9 is documented in RFC 3954, and its IETF successor, IPFIX, is defined in RFC 7011. A collector that supports v5, v9 and IPFIX will cover most enterprise gear. This guide sits within our bandwidth monitoring software coverage.

Tool	Role	Pricing type (SaaSPodium)	Runs on Windows?
ntopng	Collector and analyzer	Freemium	Yes (Windows, Linux, Mac listed)
NetCrunch	Monitoring suite with traffic analysis	Paid	Yes (Windows, on-premises)
PRTG Network Monitor	Monitoring suite with flow sensors	Freemium	Yes (Windows core server)
ManageEngine OpManager	Monitoring suite, flow via companion analyzer	Freemium	Yes (Windows server option)
Progress WhatsUp Gold	Monitoring suite with flow module	Freemium	Yes
Kentik	SaaS network observability	Paid	Browser-based (no collector install needed)
Datadog	SaaS monitoring	Paid	Agent supports Windows
Wireshark	Packet analyzer, not a collector	Free	Yes

What Is a NetFlow Analyzer, and What Does a Collector Do?

A NetFlow collector receives and stores flow records exported by network devices, while an analyzer queries that data to show who talked to whom, over which ports, and how many bytes. Most Windows products combine both roles in one service.

A flow record summarizes a conversation: source and destination address, ports, protocol, byte and packet counts, and timestamps. It does not contain payload, which keeps storage manageable and avoids capturing user content. Our deeper comparison of sFlow, NetFlow and IPFIX explains which devices export which format.

The question to settle first: free tool or free tier?

Truly free options are few. ntopng ships a community edition, and Wireshark is free and open source, but most commercial suites are limited trials or free tiers capped by sensors or devices. Decide whether you need a permanent free tool or a no-cost way to evaluate before you buy.

How We Chose These NetFlow Tools for Windows

We started from SaaSPodium directory listings in bandwidth and network monitoring and kept tools that ingest NetFlow, IPFIX or sFlow records, or that complement collectors, with a Windows-friendly deployment. We weighed pricing type, deployment options and company-size fit.

Ratings were not available for these listings when we wrote this, so we rely on published vendor taglines, deployment data and pricing type. Confirm current free-tier limits on the vendor's pricing page, because they change.

ntopng

ntopng is a web-based traffic analysis and flow collection tool from ntop. Its listing shows Linux, Mac and Windows support and a freemium model, which makes it the most natural starting point for a free Windows NetFlow collector.

• Architecture: a collector and web interface; the vendor pairs it with a separate flow-to-ntopng component for NetFlow, sFlow and IPFIX. Directory entry: ntopng.
• Fit: small and medium organizations, per the listing, with community and paid editions.
• Pricing model: freemium; check the vendor for edition limits.

NetCrunch

NetCrunch from AdRem Software is an agentless monitoring suite installed on Windows. It combines device monitoring with traffic and flow-based analysis, which suits administrators who want one on-premises product.

• Architecture: a Windows server application, on-premises. Listing: NetCrunch.
• Fit: small and medium companies, per the listing.
• Pricing model: paid, licensed by monitoring nodes; request current terms.

PRTG Network Monitor

PRTG adds flow sensors that accept NetFlow v5, v9 and IPFIX, along with sFlow, on the same Windows core server that runs its other sensors. Flow monitoring consumes sensors, so plan capacity before enabling it on many interfaces.

• Architecture: a core server with optional remote probes and a collector built in. Listing: PRTG Network Monitor.
• Vendor: Paessler, with SNMP, WMI and notification channels.
• Pricing model: freemium listing with a free tier limited by sensor count.

ManageEngine OpManager

ManageEngine sells flow analysis as a separate product, NetFlow Analyzer, that works alongside OpManager. The suite fits administrators who already monitor devices and want bandwidth reporting under one vendor.

• Architecture: central server with probes for remote sites. Listing: ManageEngine OpManager.
• Integrations: ITSM connectors and other ManageEngine products.
• Pricing model: freemium listing; paid editions are licensed by device or interface count.

Progress WhatsUp Gold

WhatsUp Gold offers a flow monitoring add-on that collects NetFlow, sFlow and IPFIX records into its console, next to maps and alerts. It runs on Windows and suits teams that prefer visual topology.

• Architecture: Windows-based server with discovery and dashboards. Entry: Progress WhatsUp Gold.
• Integrations: SNMP, WMI and REST actions.
• Pricing model: freemium listing; module licensing varies.

Kentik

Kentik is a SaaS network observability platform for large networks. Flow data is sent to its cloud, so no Windows collector database is needed, and the listing targets enterprises.

• Architecture: cloud and on-premises deployment options per the listing. Profile: Kentik.
• Fit: enterprise networks with high flow volumes and multiple sites.
• Pricing model: paid; quote-based.

Datadog

Datadog accepts flow data through its network device monitoring and runs an agent that supports Windows hosts. It is the better pick if you already use it for infrastructure monitoring and want traffic data in the same place.

• Architecture: SaaS backend with an on-host agent. Listing: Datadog.
• Integrations: many cloud and application integrations.
• Pricing model: paid, usage-based; model costs by device count.

Wireshark

Wireshark is a free packet analyzer that can decode captured NetFlow and IPFIX packets for inspection, but it does not collect or store flow records over time. Use it to verify that a router is exporting correctly, not as your long-term analyzer.

• Architecture: desktop capture and dissection tool for Windows, Linux and Mac. Listing: Wireshark.
• Use case: troubleshooting export templates, ports and malformed records.
• Pricing model: free and open source.

How to Enable Flow Export and Point It at a Windows Collector

Flow monitoring needs two settings on each exporter: a destination (the collector's IP and UDP port) and the interfaces to monitor. Collectors commonly listen on UDP 2055, 9995 or 4739 for IPFIX, but check your tool's documentation.

1. Open UDP on the Windows Firewall for the collector port, scoped to exporter IP addresses.
2. Configure the router or switch with the collector address, version (v9 or IPFIX preferred) and source interface.
3. Enable export on ingress and egress of the interfaces you care about, usually WAN and core uplinks.
4. Set a short active timeout, such as one minute, so graphs update promptly.
5. Confirm packets arrive using a Wireshark capture before trusting reports.

Sizing the Windows host

Flow volume depends on traffic mix, not link speed alone. Many small flows from web traffic create more records than a few large transfers. Start with a dedicated virtual machine, watch records per second, and size disk to your retention goal.

Here flows per second is the sustained rate your exporters send, bytes per record is the average stored size (vendors publish estimates), and retention days is how long you keep raw data. Rolling raw data up into hourly summaries reduces storage sharply.

Common Problems With NetFlow on Windows and How to Fix Them

Most failures come from the network path, not the analyzer: a blocked UDP port, a mismatched version, or an exporter sending from an unexpected source address. Work through these in order before reinstalling anything.

• No data: verify the firewall rule and that the exporter reaches the right interface IP.
• Wrong volumes: sampled exports need a sampling rate setting in the collector; unsampled records do not.
• Missing interfaces: export must be enabled per interface, in the right direction.
• High CPU on the exporter: reduce monitored interfaces or enable sampling on busy links.

Related reading: our comparison of NetFlow analyzers and collectors and the Kentik vs ntopng vs NetCrunch vs Datadog head-to-head.

Which Free NetFlow Analyzer Should You Pick for Windows?

Pick ntopng if you want a permanent free option, PRTG or WhatsUp Gold if you want flow data inside a broader monitoring suite with a free tier, and Kentik or Datadog if flow data must scale across many sites without running collectors yourself.

• Single site, tight budget: ntopng community edition on a Windows virtual machine.
• Existing monitoring suite: use its flow add-on to avoid another console.
• Many sites or cloud links: a SaaS product reduces collector maintenance.

Frequently Asked Questions

Is there a completely free NetFlow analyzer for Windows?
Yes, options such as ntopng offer a free community edition and Wireshark is free for packet-level inspection. Free editions usually limit features or retention, so check the vendor's edition comparison before relying on one in production.

How much does a commercial NetFlow analyzer cost?
Pricing models vary: sensor-based (PRTG), node-based (NetCrunch), device or interface-based (ManageEngine) and usage-based (Datadog, Kentik). Request a current quote and model costs at double your present exporter count.

How long does it take to set up a NetFlow collector?
A basic collector and one exporter can be working within an hour. Planning retention, enabling export on all key interfaces and building useful dashboards typically takes a few days to a couple of weeks.