---
name: "pflow"
section: "4"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd", "openbsd"]
url: "https://new.carta.tech/pflow"
---

# pflow(4)

kernel interface for pflow data export

## NAME

**pflow** – kernel interface for pflow data export

## SYNOPSIS

**pseudo-device pflow**

## DESCRIPTION

The **pflow** subsystem exports **pflow** accounting data from the kernel using [udp(4)](/udp/4.md) packets. **pflow** is compatible with netflow version 5 and IPFIX (10). The data is extracted from the [pf(4)](/pf/4.md) state table.

Multiple **pflow** interfaces can be created at runtime using the **pflowctl***N* **-c** command. Each interface must be configured with a flow receiver IP address and a flow receiver port number.

Only states created by a rule marked with the *pflow* keyword are exported by **pflow**.

**pflow** will attempt to export multiple **pflow** records in one UDP packet, but will not hold a record for longer than 30 seconds.

Each packet seen on this interface has one header and a variable number of flows. The header indicates the version of the protocol, number of flows in the packet, a unique sequence number, system time, and an engine ID and type. Header and flow structs are defined in ⟨net/pflow.h⟩.

The **pflow** source and destination addresses are controlled by [pflowctl(8)](/pflowctl/8.md). **src** is the sender IP address of the UDP packet which can be used to identify the source of the data on the **pflow** collector. **dst** defines the collector IP address and the port. The **dst** IP address and port must be defined to enable the export of flows.

For example, the following command sets 10.0.0.1 as the source and 10.0.0.2:1234 as destination:

```
# pflowctl -s pflow0 src 10.0.0.1 dst 10.0.0.2:1234
```

The protocol is set to IPFIX with the following command:

```
# pflowctl -s pflow0 proto 10
```

## SEE ALSO

[netintro(4)](/netintro/4.md), [pf(4)](/pf/4.md), [udp(4)](/udp/4.md), [pf.conf(5)](/pf.conf/5.md), [pflowctl(8)](/pflowctl/8.md), [tcpdump(8)](/tcpdump/8.md)

## STANDARDS

B. Claise, *Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information*, RFC 5101, January 2008.

## HISTORY

The **pflow** device first appeared in OpenBSD 4.5 and was imported into FreeBSD 15.0 .

## BUGS

A state created by [pfsync(4)](/pfsync/4.md) can have a creation or expiration time before the machine came up. In this case, **pflow** pretends such flows were created or expired when the machine came up.

The IPFIX implementation is incomplete: The required transport protocol SCTP is not supported. Transport over TCP and DTLS protected flow export is also not supported.