Netmon Docs · Device Configuration Guide

Ubiquiti UniFi / EdgeRouter / EdgeSwitchv7.0.20

Configure UniFi switches and gateways and EdgeMAX EdgeRouter/EdgeSwitch gear to mirror traffic and, from the routing tier, export NetFlow/IPFIX flow data to Netmon.

Covers the UniFi Network platform (managed switches plus a UniFi gateway such as a Cloud Gateway, UDM, or UXG) and the EdgeMAX line (EdgeRouter / EdgeOS and EdgeSwitch). Port mirroring is available across the line; flow export is gateway/router-only.

Mirror traffic (SPAN)

Both the UniFi and EdgeMAX platforms can copy traffic from one or more source ports to a destination (“probe”) port, which you cable to the Netmon sniffer NIC.

UniFi switch (UniFi Network)

  1. In the UniFi Network application, open the switch’s Port Manager and select the destination port that is cabled to the Netmon sniffer NIC.
  2. Set the port’s Operation to Mirroring, then choose the source port whose traffic you want to copy. 
    Devices > [Switch] > Ports > Port Manager > (select port) > Operation: Mirroring
Note

UniFi’s port Operation has three modes: Switching (default), Mirroring (for PCAP/security), and Aggregation. Only Mirroring produces a SPAN/monitor copy on the selected port.

Source: UniFi Switch Settings, Ubiquiti Help Center (retrieved 2026-06). https://help.ui.com/hc/en-us/articles/33402927617047-UniFi-Switch-Settings

EdgeSwitch (EdgeOS CLI)

  1. Enter Privileged EXEC mode and define the source (monitored) interface for session 1. Add rx or tx to mirror only one direction; omit both to mirror ingress and egress. 
    monitor session 1 source interface <slot/port>
  2. Set the destination (probe) interface that is cabled to the Netmon sniffer NIC. 
    monitor session 1 destination interface <slot/port>
  3. Enable the session, then verify it. 
    monitor session 1 mode
show monitor session 1
Note

A VLAN can be used as the source (monitor session 1 source vlan <vlan-id>), in which case all member ports of that VLAN are monitored. The full command form is monitor session session-id { source {interface slot/port | vlan vlan-id | remote vlan vlan-id} [rx|tx] | destination {interface slot/port | remote vlan vlan-id reflector-port slot/port} | mode | filter ... }.

Source: EdgeSwitch — CLI Reference Guide, UISP Help Center (retrieved 2026-06). https://help.uisp.com/hc/en-us/articles/22591720570135-EdgeSwitch-CLI-Reference-Guide

Export flow data

Flow export on the Ubiquiti line is a routing-tier feature: a UniFi gateway (Cloud Gateway / UDM / UXG) or an EdgeRouter exports NetFlow/IPFIX. A UniFi or EdgeMAX switch alone cannot export flow data, and sFlow is not supported on any Ubiquiti product — use NetFlow/IPFIX (UDP 9996) for these devices, never the sFlow collector (UDP 6343).

UniFi gateway (NetFlow / IPFIX)

NetFlow export reflects all traffic passing through the UniFi Gateway, so a gateway must be present.

  1. In the UniFi Network application, go to Settings > CyberSecure > Traffic Logging.
  2. Enable NetFlow (IPFIX) to send sampled traffic data to your external collector, and enter the Netmon appliance address <netmon-ip> as the destination.
  3. Set the destination/collector UDP port to 9996 so it matches the Netmon flow collector. If a different default port is presented, override it to 9996. 
    Settings > CyberSecure > Traffic Logging > NetFlow (IPFIX)
Important

NetFlow (IPFIX) export is sampled, not 1:1 — record counts will be lower than the raw packet rate by design. Enable Allow Netflow Data Collection for the gateway on the Netmon side; see Receiving the Data in Netmon.

Source: Traffic Flows and Traffic Logging in UniFi Network, Ubiquiti Help Center (retrieved 2026-06). https://help.ui.com/hc/en-us/articles/32201256219799-Traffic-Flows-and-Traffic-Logging-in-UniFi-Network

EdgeRouter (EdgeOS NetFlow)

EdgeRouter devices support exporting NetFlow data (NetFlow versions 5 and 9). When the EdgeRouter is managed by UISP, enable export from the UISP settings:

  1. Go to Settings > Network and add the EdgeRouter as a gateway, then select its WAN interface.
  2. Turn Allow NetFlow ON for that interface.
Note

For UISP/NetFlow analysis, configure NetFlow on a single (WAN) interface. Direct the export at the Netmon flow collector on UDP 9996, and where the exporter source address can be set, set it to the address Netmon knows the EdgeRouter by. EdgeOS configures flow export from the CLI under the system flow-accounting tree; use the EdgeOS configuration interface for the exact per-version settings, since the standalone CLI command strings are not published as an official help-center article.

Important

A WAN link carries both directions of Internet traffic, so enabling NetFlow on the WAN interface is the recommended single-interface placement for gateway-to-Internet flow visibility.

Source: UISP — NetFlow, UISP Help Center (retrieved 2026-06). https://help.uisp.com/hc/en-us/articles/22590965913239-UISP-NetFlow

EdgeSwitch

EdgeSwitch has no flow-export (NetFlow/sFlow/IPFIX) capability. To get flow-style visibility from an EdgeSwitch segment, either mirror the relevant ports to the Netmon sniffer NIC (see Mirror traffic (SPAN) above) or export NetFlow from the upstream UniFi gateway / EdgeRouter that routes the segment.

Source: EdgeSwitch — CLI Reference Guide, UISP Help Center (retrieved 2026-06). https://help.uisp.com/hc/en-us/articles/22591720570135-EdgeSwitch-CLI-Reference-Guide

PreviousPalo Alto PAN-OS NextReceiving the Data in Netmon