{"id":943,"date":"2010-04-08T15:48:33","date_gmt":"2010-04-08T14:48:33","guid":{"rendered":"http:\/\/mccltd.net\/blog\/?p=943"},"modified":"2010-06-08T16:20:01","modified_gmt":"2010-06-08T15:20:01","slug":"netflow-primer","status":"publish","type":"post","link":"http:\/\/darenmatthews.com\/blog\/?p=943","title":{"rendered":"NetFlow Primer"},"content":{"rendered":"

Because it is part of Cisco IOS software, NetFlow enables networks to perform IP traffic flow analysis without deploying external probes, making traffic analysis economical even on large IP networks.<\/p>\n

The key components of NetFlow are the NetFlow cache that stores IP flow information and the NetFlow export mechanism that sends NetFlow data to a collector, such as the NetFlow Collector. These two key components, the metering process and the exporting process, sometimes lead to confusion, because the term “NetFlow” refers to both of them.<\/p>\n

NetFlow operates by creating a NetFlow cache entry (also called flow record) for each active flow<\/p>\n

NetFlow maintains a flow record within the cache for active flows. Each flow record contains multiple data fields, which are exported to a NetFlow collector. The Cisco NetFlow Collection Engine (NFC) is a device that provides flow filtering and aggregation capabilities. Afterwards, Network Management applications, such as performance monitoring, security analysis, and billing solutions, can access the aggregated NetFlow records for further processing.<\/p>\n

NetFlow does not involve any connection-setup protocol between routers, networking devices, or end stations. NetFlow does not change the IP packets and is transparent to the existing network infrastructure.<\/p>\n

A flow is defined as a set of packets having common properties: one or more packet header fields (e.g. destination IP address, transport header field), one or more characteristics of the packet itself .<\/p>\n

A packet belongs to a flow record if it completely matches all defined flow properties.<\/p>\n

NetFlow defines a flow by a combination of key-fields in the packet, called “flow keys”. Usually additional information is reported in a flow, such as number of packets and bytes, start and stop time, and so on. These reporting fields do not define a flow; therefore, they are called “flow values” or “non-key-fields”.<\/p>\n

Initially, NetFlow defines a flow as the combination of the following seven key-fields:<\/p>\n