What is NetFlow?

NetFlow is a way for routers, switches and firewalls to report the traffic passing through them, as summaries of conversations rather than copies of packets. Cisco introduced it in the 1990s, and the name now loosely covers a family of formats: NetFlow itself, its IETF-standard successor IPFIX, and the sampling-based sFlow. When someone asks "who is using all the bandwidth?", flow data is usually where the answer comes from.

What a flow is

A flow is a set of packets that share the same key fields, most commonly the five-tuple: source address, destination address, source port, destination port and protocol. Many devices also key on the interface the packets came in on and their type-of-service bits.

The device keeps a flow cache. Each new packet either updates an existing entry, adding to its byte and packet counts, or starts a new one. An entry is exported as a flow record when the flow ends, for example when a TCP connection closes, when it has been idle for a while (the inactive timeout), or when it has run for a long time (the active timeout), so long-lived flows are reported in pieces rather than only at the end.

A typical record holds the five-tuple, bytes and packets, start and end times, TCP flags, and the input and output interface indexes. Depending on the device and the format, it may also carry autonomous system numbers, next hops and other fields.

Exporters and collectors

The device that builds flow records is the exporter. It sends them over UDP to a collector, a server or agent that receives, decodes and stores them. UDP keeps export cheap for the device, at the cost that a lost packet means lost records.

NetFlow v5, v9, IPFIX and sFlow

NetFlow v5 has a fixed record format. It is simple and still common, but it covers IPv4 only and can't be extended.

NetFlow v9 (RFC 3954) is template-based: the exporter first sends a template describing the fields its records will carry, then records in that layout. That made room for IPv6, MPLS labels and vendor fields without a new version.

IPFIX (RFC 7011) is the IETF standard built on v9's design, with a registry of standard information elements (RFC 7012) and support for variable-length fields. New deployments should prefer it where devices support it.

sFlow (version 5) works differently. Instead of tracking flows, the device samples one packet in N and sends the sampled packet's headers, along with periodic interface counters. It needs no flow cache, which suits high-speed switches, but every number derived from it is an estimate that has to be scaled by the sampling rate.

Sampling

Busy routers often sample NetFlow and IPFIX too, building flows from one packet in every 100 or 1,000. Sampling keeps export affordable on fast links, but it changes how to read the numbers: totals must be multiplied by the sampling rate to estimate real traffic, and short or small flows can disappear from the data entirely.

What flows tell you, and what they don't

Flow data is good at:

• top talkers: which hosts, ports and networks send and receive the most;
• capacity planning: traffic per link, per application port, per peer network;
• security: unexpected destinations, scans, unusual volumes, and a record of who talked to whom when investigating an incident;
• cost: traffic that leaves for the internet or crosses a paid link.

It doesn't contain payloads, so it can't tell you what was said, only who said it, when and how much. It identifies applications only as far as ports and protocols allow, and encrypted traffic on port 443 all looks alike. Interface numbers in records are indexes, which need SNMP data to turn into interface names.

How Tracix handles it

Flow analysis in Tracix starts at a collector on your network.

• Formats. The NetFlow / sFlow / IPFIX integration receives NetFlow v5 and v9 and IPFIX on UDP 2055, and sFlow v5 flow samples on UDP 6343. sFlow counter samples and vendor-specific fields aren't decoded.
• Records. Each flow keeps its addresses and ports, protocol, bytes and packets, exporter, interface indexes, the autonomous systems the exporter reports, the sampling rate and TCP flags.
• Flow Analysis. Under Network › Flow Analysis, tabs show an overview, conversation partners, traffic over time, top talkers, a geographic map, exporters, a connection graph and raw records, starting from the last 15 minutes and going back up to 30 days. Public addresses get a location and an autonomous system from DB-IP's databases when you query, and private ones count as internal. Conversations whose TCP flags include a reset are counted under Anomalies.

Some limits, stated plainly: sampled flows aren't scaled up, so with sampling the totals shown are the sampled totals; interfaces appear as indexes, not names; applications are grouped by protocol and port, with no deep packet inspection; and the page works from the 100 largest conversations in the time range, so its totals describe those conversations, not all of your traffic.

NetFlow, IPFIX and sFlow covers the setup, and Flow analysis covers reading the page.

IP geolocation by DB-IP, licensed under CC BY 4.0.