NetFlow Tutorial

NetFlow gives administrators visibility into network health, bandwidth usage, and application traffic that goes well beyond what SNMP or SPAN (port mirroring) can provide on their own. In short, NetFlow is built to answer the questions of who is generating traffic, what kind of traffic it is, when it happens, where it’s going, and how it’s flowing through the network.

NetFlow Components

• NetFlow Monitor — applied to an interface to actually collect flow information. It’s made up of a record (which defines what gets matched and collected) and a cache (where that collected data is stored).
• NetFlow Exporter — groups related packets together into flows, stores them in the NetFlow cache, and exports the resulting flow records off to a collector.
• NetFlow Collector — receives, parses, and stores the flow records sent by exporters. It’s usually implemented as software running on a server, and flow records are sent to it over UDP.
• NetFlow Sampler — optionally reduces the number of packets actually analyzed, which lowers processing overhead at the cost of some accuracy.

A flow itself is defined as a unidirectional stream of related packets.