IPFIXNetFlow

IPFIXNetFlow is a term used to describe approaches and configurations that enable NetFlow data to be exported, collected, and analyzed within the IPFIX framework. It generally refers to exporting NetFlow records using IPFIX syntax, or to systems that bridge NetFlow data with the IPFIX Information Model for unified collection and analysis.

Background and relationship: NetFlow originated with Cisco and has evolved through several versions, including NetFlow v5 and v9. IPFIX, defined by the IETF (RFC 7011 and related specifications), was designed as a standards-based successor that builds on NetFlow v9 concepts. In practice, many devices can export NetFlow records in IPFIX format or map NetFlow data into IPFIX templates, enabling standardized processing across diverse collectors and analytics platforms.

Technical overview: IPFIX defines a flexible Information Element (IE) model and templates that describe the structure of exported data. When NetFlow data is carried under IPFIX, NetFlow fields such as source and destination addresses, ports, protocol, and counters are represented as IPFIX IEs within templates. The exporter and collector negotiate and refresh templates, and data records are transported as IPFIX records. Interoperability is achieved through explicit mappings and adherence to IPFIX’s information model, allowing different vendors to interoperate when converting NetFlow data to IPFIX or exporting directly in IPFIX.

Deployment considerations: Common use cases include network performance monitoring, usage-based billing, and security analytics. Practitioners should manage template lifecycles, data volume, and potential privacy considerations, ensuring consistent mappings and sufficient processor capacity on exporters and collectors.

See also: IPFIX, NetFlow, flow information export.