netflow

NetFlow is a network protocol and data collection framework originally developed by Cisco Systems to capture information about IP traffic as it enters or leaves an interface on a router or switch. NetFlow defines a flow as a unidirectional sequence of packets that share common attributes, such as source and destination IP addresses, source and destination ports when applicable, the protocol, and the ingress interface, along with timing and statistics like start and end timestamps and byte and packet counts.

In a NetFlow deployment, an exporter runs on network devices and generates flow records that are sent to a NetFlow collector or analyzer. The collector stores, aggregates, and analyzes flow data to provide visibility into traffic patterns, usage, and performance. This information supports a range of activities, including capacity planning, traffic engineering, security analytics, and billable traffic accounting.

Versions and evolution: NetFlow began with Cisco’s early implementations and evolved to NetFlow version 5, which uses a fixed field set and is widely deployed. NetFlow version 9 introduced a template-based export mechanism, enabling a flexible information model. The Internet Protocol Flow Information Export (IPFIX) standard, developed by the IETF, formalizes this approach and is commonly treated as the standardized evolution of NetFlow v9.

Deployment and limitations: A typical setup includes NetFlow-enabled devices (exporters), a collector, and analysis software. Some deployments employ sampling to reduce overhead, which can affect accuracy. NetFlow collection involves processing IP header information and is subject to device performance, privacy considerations, and regulatory constraints regarding data retention and visibility into network activity.