» PRODUCT
Flow-based diagnostics
for your network.
» WHO IT IS FOR
Built for your environment.
WISPs & ISPs
Traffic shifts, DDoS pressure and customer complaints land on your desk first.
FLOWCUTTER shows what changed and who is affected — in minutes, with evidence you can share.
Telco, transit & IX
Port statistics show activity, but not what actually moves across transit links, peering and the IX fabric.
FLOWCUTTER shows traffic between upstreams, peers and members — fast, on large flow datasets — and where unusual behavior begins.
Private data centers
When something odd starts inside the environment, locating it is slow.
FLOWCUTTER identifies where it began, which workloads are involved and what changed.
How it works
» AI LAYER
FLOWCUTTER finds it.
Your AI explains it.
Ask your AI, right on the dashboard.
Open FLOWCUTTER, ask what’s going on. You get a plain answer and the next step — in seconds.
Let your AI write the report.
Daily, weekly or on one topic — for your team, your boss or your auditor.
Your network, last 24 hours.
- HIGHUDP flood on one customer IP, now stopped
- INFONew traffic to an unusual destination from one customer router
This week in your network.
- OKNo DDoS attacks detected
- HIGHOne new open service on your public IP ranges
- INFOTop traffic sources changed since last week
How your traffic moved between peers.
- INFOPart of your traffic shifted from transit to the IX
- INFOOne peer AS carries a growing share of your traffic
Built in.
Always running.
Deep NetFlow diagnostics
NetFlow, IPFIX and sFlow reveal who communicates with whom — insight SNMP alone cannot provide. Combined with SNMP, syslogs and IP reputation, it shows what caused anomalies, attacks and misconfigurations.
Automated anomaly detection
Pre-defined templates cover incoming volumetric DDoS floods (SYN, SYN-ACK, ICMP, DNS, NTP), outgoing amplification attacks via open DNS, and intra-network changes such as scanning, brute force and anomalies on service ports.
Automated vulnerability scan
Continuously checks your IP ranges for open ports, service versions and known CVEs with severity classification — no manual triggering, all findings in an auditable overview.
Threat intelligence
Traffic matched against known malicious sources and indicators, so suspicious destinations surface before they become incidents.
What makes FLOWCUTTER different
Grafana-native front end
Dashboards, ad-hoc query engine and alerting via email, Slack or webhook.
Proprietary flow backend
Built for ad-hoc queries on large flow datasets.
Passive by design
Reads the flow data your routers already export, or a copy via SPAN/TAP with the FLOWCUTTER Probe. Nothing sits in the traffic path.
Engineers behind it
Our engineers tune detection with you, walk you through the findings and stay reachable — not a ticket queue.
Runs on the gear you already have
Works with NetFlow, IPFIX and sFlow exports — MikroTik, Cisco, Juniper, Huawei, Arista, Nokia, or any flow-capable device.
» SEE IT IN ACTION
From alert to answer.
4 minutes.
Common questions
Is FLOWCUTTER a SIEM?
No — it complements one. FLOWCUTTER adds the network context SIEMs usually lack, and its data can be exported to or correlated with Zabbix, Elastic, Sentinel and others.
What does FLOWCUTTER detect?
- DDoS and volumetric attacks
- DNS floods and amplification
- Lateral movement
- Suspicious outbound traffic from customer devices
- Slow-building problems such as degradation, misrouting or abnormal growth.
Built-in vulnerability scanning also checks your IP ranges for open ports and known CVEs.
Is detection automatic?
Yes. Ready-made detection runs from day one. Behavioral baselines learn your network over about 2 weeks, then flag what is unusual for you, not just for networks in general.
Why isn’t BGP and SNMP monitoring enough on its own?
BGP shows how traffic should flow. SNMP shows how much flows. Only flow data shows who talks to whom, when and for how long — which is where attacks, congestion and degradation actually show up. FLOWCUTTER correlates all three.
How does this compare to IDS/IPS?
They work best together. IDS/IPS inspects packets; FLOWCUTTER watches network-wide behavior over time and answers where, since when and with what impact.
Can we use our own AI with FLOWCUTTER?
Yes, optionally. FLOWCUTTER dashboards come with prompts for Claude or ChatGPT. Your AI works in your browser through a read-only account, reads the data and sums up what happened in your network — it can also suggest a fix.
It can't change anything in FLOWCUTTER or your network. The AI tool and its licence are your choice. The AI provider you choose processes the data it reads, including IP addresses, so check it against your data policy.