Noction Flow Analyzer contains a few fundamental components, which working together implement the main function of NFA – offer timely traffic flows information that is easy to interpret and analyze.
nfaflowd runs a parallel processing pipeline for flow ingestion, normalization, enrichment, and storage.
nfabgpd maintains BGP sessions, the Routing Information Base (RIB), route attributes, and the looking-glass service.
nfasnmpd periodically collects interface counters and metadata via SNMP.
nfadnsd resolves IP addresses to fully qualified domain names (FQDNs) and caches the results.
nfaconfd serves centralized configuration parameters and publishes configuration changes.
NATS provides messaging infrastructure for communication and data exchange between NFA services.
nfaad detects traffic anomalies based on configured detection parameters and historical data.
nfaalertd evaluates alert conditions associated with flow data.
nfathreshd monitors configured thresholds using live flow subscriptions.
ClickHouse stores flow records, traffic metrics, and historical data used for analysis and reporting.
MySQL stores persistent configuration data, including widgets, dashboards, filters, devices, alerts, users, and rules.
nfapushd formats and delivers notifications to external destinations, including email and webhooks.
nfaapid is the C++ API service that processes API requests from the NFA frontend and third-party applications. It supports reporting, data exploration, and subscriptions and requires valid authentication tokens.
nfanapid is the Node.js API service that provides secure web services, proxies requests to nfaapid, and interacts with the frontend. It primarily handles configuration management, authentication, and authorization.
NFA Frontend provides a web interface for exploring network traffic, viewing reports and graphs, and analyzing current and historical network activity.
Routers / Switches are network devices that provide flow exports, BGP routing information, and SNMP data to NFA.
DNS Servers provide DNS information used for IP-to-FQDN resolution.
Email / Webhook represents external notification destinations that receive alerts and events delivered by nfapushd.