NetFlow

NetFlow is a feature that was introduced on Cisco routers around 1996 that provides the ability to collect IP network traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can determine things such as the source and destination traffic, class of service, and the causes of congestion. A typical flow monitoring setup (using NetFlow) consists of three main components:^[1]

• Flow exporter: aggregates packets into flows and exports flow records towards one or more flow collectors.
• Flow collector: responsible for reception, storage and pre-processing of flow data received from a flow exporter.
• Analysis application: analyzes received flow data in the context of intrusion detection or traffic profiling, for example.