flowlog

Flowlog refers to a log or telemetry record that captures information about network flows, the communications between endpoints over a period of time. Flowlogs are used to provide visibility into traffic patterns, enable security monitoring, support capacity planning, and assist with incident response. They focus on the metadata of communications rather than the content of the payload, allowing scalable analysis across large networks.

A typical flowlog entry records key attributes of a network flow, such as a timestamp, source and destination IP addresses, source and destination ports, the transport protocol, and the direction of traffic. Additional fields may include the number of packets, the total number of bytes, flow duration, interface or device identifiers, TCP flags, and sometimes network ASN information or NAT labels. Some systems also indicate whether a flow was accepted or dropped by a device or firewall.

Flowlogs are commonly produced in standardized formats such as NetFlow, IPFIX (IP Flow Information Export), and sFlow. NetFlow originated with Cisco and evolved through several versions; IPFIX is an IETF standard that formalizes flow information, while sFlow emphasizes sampling for high-speed networks. Flowlogs are typically exported to a collector, a security information and event management system, a data lake, or a real-time analytics platform for processing and visualization.

In cloud environments, flow logs are offered as managed services, for example AWS VPC Flow Logs, Azure Network Watcher flow logs, and Google Cloud VPC Flow Logs. These integrate with cloud monitoring, security tooling, and billing systems. Privacy, storage, and processing costs are important considerations, as flowlogs provide valuable visibility but do not reveal payload content and may be subject to sampling and retention policies.