Akvorado → Kentik
Akvorado ↔ Kentik: integration to migration path.
Akvorado deploys alongside Kentik first — every exporter dual-collecting to both ingests, sampling rate frozen, Kentik still owning every user-facing dashboard. Only once Akvorado has proven volumetric and enrichment parity against the exact stream Kentik sees does it take over the flow plane in phases. No flag day, no rate change mid-flight, and every step rolls back in minutes.
The honest scope is Kentik Core only: Synthetic, NMS, AI peering and Map are SaaS-only with no OSS parity and remain on Kentik as steady state. We say so up front — the rest only matters if you can trust it.
The idea
Dual-collect every flow to both ingests first.
The trick that makes this zero-downtime is router-side fan-out: every flow exporter sends NetFlow, IPFIX or sFlow to both Kentik's regional ingest and the akvorado-inlet service, and each route reflector opens a second BMP session to Akvorado's listener. For sFlow estates this is a native multi-destination line; for capped exporters a samplicator HA pair fans the datagram out. Kentik keeps owning the user-facing dashboards — plus Synthetic, NMS and AI peering — while Akvorado quietly builds a second, fully BMP-enriched copy of the firehose under your own retention, RBAC and cost, ready to take over when the gates pass.
The phases
Six steps. Each one reversible.
Baseline & inventory
Read-only audit of every flow exporter: format, sampling rate, target capacity, NFv9 template interval, BMP peer count and sustained flows-per-second. We document which Kentik SKUs are actually in contract — Core, Synthetic, NMS, AI peering — and the contract anniversary.
Akvorado live on a canary
Akvorado deploys — inlet, orchestrator, console, Kafka and a sharded ClickHouse cluster — and a canary slice of exporters (≥5% of flow volume) dual-collects to both Kentik and Akvorado. BMP from the route reflectors opens a second session to Akvorado. We reconcile volumetrics within 2%.
Estate-wide dual-collect
The second exporter target rolls out in waves — edge, distribution, core — with a gate between each. Sampling rate stays identical to the existing Kentik config; we never improve rates mid-migration. Both systems now see the same flow firehose, BMP fully fanned out.
Move analytics and alerts to Akvorado
Every Kentik dashboard, saved query and alert gets a tested Akvorado console or Grafana-over-ClickHouse equivalent, validated side-by-side for at least 30 days. Kentik AI-dependent signals like BGP outage detection are documented as not migrating — they stay on Kentik or a separate workstream.
Cut Kentik Core flow ingest
Working core to edge to limit blast radius, flow exporters stop sending to Kentik and BMP to peer_kentik is torn down. Kentik Synthetic, NMS and AI peering keep running on their independent paths. This is the recommended steady state — topology 1.3.
Full Kentik retirement (optional)
Only if the customer explicitly accepts losing the SaaS-only features in writing: Synthetic moves to ThousandEyes or OSS NPM primitives, NMS to LibreNMS / Alloy / Telegraf, and the Kentik account is terminated. Each replacement is a separate sub-project with its own gates.
Feature parity
Where Akvorado matches Kentik — and where it doesn't.
| Capability | Akvorado | Kentik | Parity |
|---|---|---|---|
| Flow ingest (NetFlow / IPFIX / sFlow) | akvorado-inlet → Kafka → ClickHouse | Kentik Core regional flow ingest | At parity |
| BGP / AS-path enrichment | BMP listener writing DstASPath, DstCommunities, DstLargeCommunities at write time | peer_kentik BGP/BMP peering | At parity |
| Forwarding-status / drop visibility | ForwardingStatus IPFIX IE 89 preserved as a column | Kentik dimension surface | Partial |
| DSCP / ECN preservation | DSCP + ECN stored as separate columns | Kentik surfaces DSCP; ECN unconfirmed | Partial |
| Raw flow / query surface | Full ClickHouse SQL over the flows table, no API quota | Kentik Data Engine SQL, scoped + rate-limited | Partial |
| Dashboards / topology | Akvorado console + Grafana over ClickHouse | Kentik first-party UI + Kentik Map (flow-overlay topology) | Partial |
| AI peering analytics | None (sees only your own AS-paths) | Kentik AI peering (cross-customer market data, RPKI) | SaaS only |
| Synthetic / NPM | None | Kentik Synthetic (global agent mesh) | SaaS only |
| Device monitoring (SNMP / streaming) | None | Kentik NMS (SNMP + streaming telemetry) | SaaS only |
| BGP outage detection | None (only your RR-exported RIB) | Kentik AI global BGP outage / RPKI insight | SaaS only |
| CDN / transit classifier | None (DIY PeeringDB + CAIDA) | kt_src_market vendor-curated dimension | SaaS only |
| Multi-tenancy | DB-per-tenant or tenant column + ClickHouse row-policy | Kentik account / sub-account model | At parity |
| Retention / storage | MergeTree TTL ladder, fully tunable (raw 7–30d → rollups) | Per-SKU tier; over-quota means upgrade | At parity |
| Cost model | Compute + ClickHouse storage + ops; no per-flow charge | Per-flow / per-device / per-MAU SKU pricing | Partial |
| Compliance boundary | Self-hosted; you own SOC 2 / ISO controls + evidence | Vendor-operated SOC 2 boundary | SaaS only |
What we're honest about
The caveats most vendors leave out.
Akvorado replaces Kentik Core only, not the whole platform
Akvorado is a clean 1:1 for flow plus BMP plus dimensions. It is not a replacement for Kentik Synthetic (global agent mesh), NMS (SNMP / streaming telemetry), AI peering (cross-customer market data) or Map (first-party topology). Those remain on Kentik as steady state, with documented exit paths only if you later choose to drop them too.
AI peering analytics has no OSS parity
Kentik AI peering is a SaaS data-network-effect feature — it aggregates flow across many customers plus transit-market pricing to suggest peers. Akvorado sees only your own AS-paths, never the market. The closest substitute is a peering-engineering consultant plus PeeringDB and CAIDA scripts: partial and high-effort. We will tell you where that is a real change rather than pretend it isn't.
Synthetic, NMS and BGP-outage detection do not migrate
Akvorado does no synthetic monitoring and no SNMP/streaming device polling at all, and it sees only the BGP table your route reflectors export — not the global view Kentik uses for outage and RPKI insight. ThousandEyes, LibreNMS and bgpalerter against RIPE RIS are the honest comparators, each a separate workstream, never an implicit cut.
You own retention, ops and the compliance boundary
Self-hosting flow means a real SRE workload — ClickHouse, Kafka and samplicator HA across regions — and a SOC 2 / ISO boundary that now includes your own data plane. We run it HA with multi-AZ replicas, ClickHouse-keeper and a tested DR restore, and keep Kentik dual-collect for an extra 90 days post-Phase 3 as belt-and-braces before anything is cut.
Why this beats a flag day
Reversible per phase, gated before any cut.
Every phase rolls back in under 15 minutes — remove the second exporter line and Kentik is untouched, or re-add the Kentik target and Core ingests immediately — because nothing is cut until its replacement is proven. Akvorado does not become primary until 30 consecutive days of side-by-side alert evaluation show no missed pages, and we hold Kentik dual-collect for an extra 90-day soak window as belt-and-braces before Kentik Core flow ingest is finally cut. You are never betting flow visibility on one big cutover.
See whether your flow estate migrates cleanly.
A 30-minute call with a senior network-telemetry engineer. We inventory your exporters, sampling rates and BMP headroom, confirm which Kentik SKUs you actually use, and tell you honestly whether Akvorado replaces Kentik Core for you — and which SaaS-only features stay.
Map my migration →