What is IPFIX?
IPFIX, short for IP Flow Information Export, is the IETF's standard protocol for sending flow records from network devices to collectors. A flow record summarizes one direction of a conversation: addresses, ports, protocol, start and end times, and packet and byte counts, but never the payload. Cisco's NetFlow version 9 was the starting point, and the IETF developed it into an open standard, first published in 2008 and now specified in RFC 7011 (2013), with the definitions of the data fields in RFC 7012. IPFIX messages carry version number 10 in their header, which is why it is sometimes called NetFlow v10. Routers, firewalls, switches and dedicated probes from many vendors export it, and most flow collectors and SIEMs accept it. Flow analysis itself, such as spotting exfiltration or beaconing, works the same whichever format carries the records.
How IPFIX works
- Templates. The exporter first sends a template listing which fields it will send and their lengths, then data records that follow it. The collector needs the template to decode anything, so over UDP templates are re-sent on a schedule.
- Information elements. Each field is a numbered information element from a registry IANA maintains, so every vendor means the same thing by the same number. Vendors can define extra elements under their own enterprise number.
- Variable-length fields. IPFIX defines fields whose length can vary from record to record, so it can carry strings such as application or host names when the exporter supports them; NetFlow v9 fields have fixed lengths.
- Transport. RFC 7011 defines SCTP, TCP and UDP transport. The registered port is 4739, with 4740 for IPFIX over TLS or DTLS. Plain UDP is widely used because it is simple, but it is unauthenticated and can lose records silently.
Example: reading one record
| Element ID | Name | Value |
|---|---|---|
| 8 | sourceIPv4Address | 10.31.4.22 |
| 12 | destinationIPv4Address | 198.51.100.140 |
| 7 | sourceTransportPort | 51877 |
| 11 | destinationTransportPort | 443 |
| 4 | protocolIdentifier | 6 (TCP) |
| 2 | packetDeltaCount | 14 |
| 1 | octetDeltaCount | 3,118 |
| 152 | flowStartMilliseconds | 2026-10-22 03:15:41.077 |
On its own the record describes one short HTTPS session. Its value comes from retention: records this small can be kept for months, so when threat intelligence flags 198.51.100.140 next week, a single query lists every internal host that ever talked to it, without anyone having captured the encrypted traffic itself.
Securing the flow pipeline
Flow export is telemetry an attacker would like to blind or poison. Send it over a management network, configure collectors to accept records only from known exporters, and use TLS or DTLS where both ends support it. Alert when an exporter goes quiet. Many devices sample traffic, recording only one packet in hundreds or thousands, so note the sampling rate before treating byte totals as exact.
IPFIX vs. NetFlow vs. sFlow
- NetFlow: Cisco's format; v5 has fixed fields and handles only IPv4, while v9 introduced templates.
- IPFIX: the open IETF standard built from v9, with a shared element registry and variable-length fields.
- sFlow: a separate standard that samples one packet in N and sends the sampled packet headers and interface counters instead of building flow records on the device.
IPFIX on the CompTIA Security+ exam
IPFIX appears alongside NetFlow in SY0-801 objective 4.4, among the protocols used for monitoring, and in objective 4.8, as a data source for investigations. On the exam the two fill the same role. Wording such as "which host sent the most data to an external address," "connections to the same server at regular intervals" or "an open standard for exporting flow data" points to IPFIX or NetFlow. The main distractor is a packet capture: if the question needs content, such as a file name or a DNS query, flow data cannot answer it. SNMP is the other trap, since it reports device counters, not who talked to whom.