{"id":9734,"date":"2019-09-19T10:00:11","date_gmt":"2019-09-19T14:00:11","guid":{"rendered":"https:\/\/www.eginnovations.com\/blog\/?p=9734"},"modified":"2022-10-31T08:04:16","modified_gmt":"2022-10-31T12:04:16","slug":"what-is-netflow","status":"publish","type":"post","link":"https:\/\/www.eginnovations.com\/blog\/what-is-netflow\/","title":{"rendered":"What is NetFlow? – The Complete Guide to Cisco NetFlow Monitoring"},"content":{"rendered":"

<\/span>\"LearnIntroduction to Cisco NetFlow<\/span><\/h2>\n

The increasing complexity of IT Infrastructure demands extensive network visibility and security. For those who have been working in networking for a while, NetFlow is not a new technology. Cisco created the network protocol “NetFlow” many years ago, which became the primary norm for collecting IP traffic information. Net Flow soon found its place within network management by providing valuable data of network performance and traffic analytics.<\/p>\n

<\/span>What is NetFlow?<\/span><\/h2>\n

NetFlow<\/a> is widely used for collecting and analyzing network flow data statistics. This protocol’s datagram carries information like the source and destination ports, source IP addresses, destination IP addresses, IP protocol, and the IP service type. If we collect flow records from all flow-enabled network devices \u2014 routers, switches, etc. \u2014 we will have an understanding of where network traffic data is coming from and going to, how much traffic is being generated, who is consuming most bandwidth, and more. These data points can be used for anomaly detection, monitoring bandwidth usage, capacity planning, and to validate the effectiveness of QoS policy.<\/p>\n

Simplify NetFlow Traffic Analysis and Bandwidth Monitoring \u00bb<\/a><\/div>\n

<\/span>History of NetFlow and Versions Released Over Time<\/span><\/h2>\n

The first NetFlow version 1 was supported in all the initial flow monitoring releases. Versions 2, 3, and 4 were only usable as internal releases. v5 is the most commonly used version because it has a fixed packet format and is still supported by various routers. Versions 7 and 8 had a few improvements and they are no longer in practice. Meanwhile, version 9 is simplified since this version has FNF capabilities enabled and incorporates a dynamic packet format. Nine versions later, NetFlow still gains popularity not only due to its performance in network management, but also as a significant component of security operations.<\/p>\n

IPFIX is referred to as NetFlow v10. It’s an industry-regulated version of the Cisco flow protocol.<\/p>\n

The primary output of all these protocol versions is a flow record. This technology has matured over the years and created numerous formats of flow records. The most used flow-record format is version 9, which is a flexible way to record network performance data. It is the foundation of a new IETF standard.<\/p>\n

\"Netflow<\/p>\n

Understanding a NetFlow flow record<\/em><\/p>\n

v9 comes with the Flexible NetFlow packets (FNF), which gives a broader view of what is happening in the network, thereby making it useful for:<\/p>\n