Kentik

Kentik is a traffic analytics service that collects the flow records exported by routers, switches and public clouds and lets you query them in seconds from a browser. Wikipedia says the company was set up in San Francisco in 2014 under the name CloudHelix and took its current name in 2015. Its own About page explains that it was founded by network operators from Akamai, Netflix, YouTube and Cloudflare, including chief executive Avi Freedman. Since August 2026 Kentik has belonged to Infoblox, the DNS and IP address management vendor, which announced on 6 August that it had completed the acquisition and plans to fold Kentik’s capabilities into its own platform over time.

The service is proprietary and offered only as SaaS. Kentik now describes itself as a network intelligence platform, a label that covers flow analytics, device monitoring, synthetic testing and an AI-driven assistant for investigations.

What Kentik is for

Everything starts with flow telemetry. A router can summarise each conversation passing through it in a NetFlow, sFlow or IPFIX record listing addresses, ports, volume and interface. Kentik ingests these records by the million and enriches them on arrival with the BGP routing table, IP geolocation and SNMP interface details. An engineer can then ask which autonomous systems send the most traffic towards their customers, which interconnection point it enters through and what it costs in transit fees.

Storage relies on the Kentik Data Engine, a distributed datastore modelled on Dremel, Google’s analytics engine. In a 2016 engineering post, Kentik described a query over roughly 1.8 billion rows, split into 10,800 parallel subqueries, that came back in under five seconds, and noted that flows received a few seconds earlier were already searchable. Around that engine the company has added multi-cloud observability, device monitoring through SNMP and streaming telemetry, SD-WAN visibility, denial of service detection, peering analysis and synthetic tests.

Within our software library, the most useful comparison is with ntopng. Both read the same NetFlow and sFlow data, but ntopng is installed on a server you look after yourself and suits a company or campus network well. Kentik is built for the scale of a carrier, a hosting provider or a multinational, with thousands of devices and one shared dataset for every team. ThousandEyes and Catchpoint come at the problem from the other side, with active tests launched from agents. Kentik has synthetic tests too, yet its strength remains the analysis of real traffic.

Who is it for?

Kentik’s natural audience is internet service providers, transit carriers, hosting companies, high-traffic online services and large enterprises spread across several data centres and clouds. Peering managers use it to negotiate interconnections, security teams to spot volumetric attacks and capacity planners to see a congested link coming. The About page shows logos of customers such as Zoom, Dropbox, eBay and Equinix.

For a small organisation the cost is hard to justify. The Pro plan starts at 2,000 dollars a month billed annually, and that figure applies to the United States only. You also need equipment able to export flows, and you have to accept that traffic data is processed in the vendor’s cloud, which can be a sticking point under strict data residency rules. A modest network will be better served by ntopng or LibreNMS, hosted in-house at no cost.

Download Kentik safely

The trial starts from the pricing page on kentik.com, which offers thirty days free of charge. The same page spells out the Pro plan: 24,000 dollars a year for 50 users, 1,000 flows per second, 25 monitored devices, 120 days of traffic data retention and 13 months for device metrics. Premier is priced on request, and contracts are annual only.

In most cases nothing has to be installed, since routers are simply configured to send their flows to Kentik. For private networks and remote sites the vendor supplies Linux agents. The Universal Agent, which is gradually replacing the older kprobe and kproxy agents, ships as a .deb package for Debian 11 to 13 and Ubuntu 20.04 to 24.04 and also supports Oracle Linux 9. The kbgp BGP proxy and the ksynth test agent come as Debian and RPM packages and as Docker images. Instructions are on kb.kentik.com, and packages come from Kentik’s packagecloud repository or its Docker Hub account. A binary with the same name found anywhere else, meant to run as root in the middle of your network, is not worth the risk.

Frequently asked questions