Collector (Kolektor)

A collector is a part of a monitoring system that gathers data sent by network devices or agents (known as exporters), tidies it up, stores it, and then makes it available for analysis. In networking it most often means a flow collector that takes in NetFlow, IPFIX, or sFlow records, or a log (syslog) collector that gathers events from systems. The collector sits in the middle of the exporter → collector → analyzer chain: it does not create the data and usually does not judge it — it brings together a stream of telemetry from many sources. “Telemetry” here simply means measurement data about what is happening in the network and systems.

How does a collector work?

A device or agent (the exporter) watches traffic or events, packs them into records, and sends them over the network to the collector. The collector waits on a defined port, receives the data, decodes its format, brings everything into one common shape, and stores or forwards it. Along the way the records go through a few steps:

1. Reception — the collector listens on a port and accepts data from exporters.
2. Decoding and normalization — reading the format and bringing fields into one shape (IP addresses, ports, protocol, byte and packet counts, timestamps). In NetFlow v9 and IPFIX, the field layout is described by templates that travel with the data.
3. Enrichment — optionally adding context, such as geographic location (GeoIP), information about the source network (ASN), interface names, or application labels.
4. Storage — writing to a database built for large amounts of time-stamped events (for example a columnar one such as ClickHouse), so the history can be searched later.
5. Delivery — passing data to an analyzer, dashboards, or downstream systems such as a SIEM (a system that collects and correlates security events) or a data warehouse.

Which protocols does a flow collector support?

Network collectors receive flow data in several standards. They differ in how they collect data and in the default transport port they use:

• NetFlow (Cisco) — versions v5 and v9; sends full flow statistics. Commonly defaults to UDP/2055 (the port can be changed).
• IPFIX — an open IETF standard (RFC 7011), the successor to NetFlow v9, based on templates; it allows custom fields (Information Elements) to be defined. By default, it uses port 4739 (SCTP, TCP, or UDP).
• sFlow — based on packet sampling, meaning it looks at a portion of packets rather than all of them; defaults to UDP/6343. It has low overhead and scales well, but gives an approximate (statistical) picture rather than a complete one.
• J-Flow (Juniper) and NetStream (Huawei) — vendor equivalents of NetFlow.

Exporters include routers, switches, firewalls, load balancers, packet brokers, and dedicated probes. In the cloud, flow logs (e.g., VPC Flow Logs) play a similar role, sent to a collector or analytics service.

How does a log collector differ from a flow collector?

Both receive data, but they differ in the kind of data and in how it is sent:

• A flow collector gathers data about network connections — who talked to whom, how much, and when — without looking inside the content of those connections.
• A log collector gathers events from systems, applications, and devices (structured or as plain text), usually over syslog (UDP/514, or TCP/6514 for the TLS-encrypted version) or through agents.

In practice, a security team (SOC) often brings both kinds of data together: a log collector or flow collector feeds a SIEM, while the flows themselves go to NDR (Network Detection and Response) tools, which spot threats based on network traffic.

What is the collector in OpenTelemetry?

In application monitoring (observability), the OpenTelemetry Collector is a separate, vendor-neutral process that receives, processes, and forwards three kinds of data: traces (the path of a request through an application), metrics, and logs. It is made of components wired into processing pipelines:

• Receivers — accept data, for example over the OTLP protocol, from applications and other sources.
• Processors — transform data along the way: filter, sample, enrich, or strip out sensitive fields.
• Exporters — send data to destination systems or to further collectors.

It is deployed in two ways: as an agent close to the application (on the same host or next to it) and as a gateway — a shared collection point for many agents. It helps to tell a collector apart from a single exporter: an exporter is one component that ships data to one destination, whereas a collector is the whole service that ties together reception, processing, and many exporters at once.

Why does a collector matter for security?

The collector is where a single, coherent picture of what is happening in the network and systems comes together — and that picture is the basis for detecting threats and for analysis after a breach. For a security team (SOC) and for NDR tools, this has several concrete effects:

• Visibility — flow data shows communication that application logs miss: movement between machines (lateral movement), port scanning, or an infected machine regularly “checking in” with the attacker’s server (beaconing to C2).
• Anomaly detection — historical data in the collector lets you learn what normal traffic looks like and catch deviations: unusual volumes, data leaving the network (exfiltration), connections to new addresses.
• Evidence — records kept for a longer time let you reconstruct an incident: who, when, and over which channel.
• Correlation — normalized data from the collector feeds a SIEM, where it is joined with other event sources.

The collector itself can also be an attack target or a weak point. Flow protocols usually run over UDP without checking the sender’s identity, so an attacker can impersonate an exporter and send fake records (spoofing). For that reason collectors only accept data from trusted sources, are placed in a separate management network, and log channels are encrypted (syslog over TLS). If a collector is flooded with too much data, some telemetry can be lost — a concern for both performance and security.

Learn more

• Data Exfiltration (Wyciek danych) — Collector gathers flow data that can help detect and investigate data exfiltration.
• What is NetFlow and how is this protocol used in practise? — Collector receives NetFlow records from devices and forwards them for analysis.
• Cyber Kill Chain — Collector supplies network data used to track activity across kill chain stages.