Netflow

Netflow is a method developed by Cisco for capturing and analysing traffic flows in networks. Rather than packet contents, it records flow metadata including source and destination IP addresses, source and destination ports, protocol, type of service and input interface. The data is collected on routers and switches and exported to a Netflow collector, where it is analysed and visualised. Netflow is used for capacity planning, usage-based accounting, fault analysis and the detection of anomalies such as port scans, denial of service attacks or unusual data transfers. Widely used versions include Netflow v5 and v9, while IPFIX provides a vendor-neutral standardised equivalent. For operating larger networks, Netflow delivers an important basis for visibility and security.