What is NetFlow?
NetFlow is a protocol, created by Cisco, that summarizes network traffic as flow records instead of copying the packets themselves. A router, switch or firewall acting as an exporter watches traffic pass through it, groups packets that belong to the same conversation, and sends a short record of each conversation to a collector. Analysts then query the collector to answer three questions: who talked to whom, when, and how much data moved.
A flow is identified by shared key fields, usually the 5-tuple: source IP address, destination IP address, source port, destination port and protocol. Cisco's classic definition also uses the type of service value and the input interface. Each record carries start and end timestamps, packet and byte counts, and TCP flags. It holds no payload.
How NetFlow works
- Exporter: the network device that builds flow records from the traffic it forwards. It sends a record when a flow ends, goes idle, or reaches the active timeout set for long-running connections.
- Collector: the server that receives and stores records, commonly listening on UDP 2055 for NetFlow or UDP 4739, the registered port for IPFIX.
- Analyzer: the software, often part of a SIEM or network detection tool, that searches, graphs and alerts on the stored flows.
Versions matter. NetFlow v5 has a fixed record format and handles only IPv4. NetFlow v9 uses templates, so it can describe IPv6 and new fields. IPFIX (IP Flow Information Export) is the IETF standard built from v9, supported by many vendors and sometimes called NetFlow v10. sFlow takes a different, sampling-based approach that records one packet in N. Flow records are one-directional, so a single TCP conversation normally produces two records, one for each direction.
Example: spotting exfiltration and beaconing in flow records
A collector shows this pair of records for a workstation at 01:52:
10.8.3.44:50311 -> 203.0.113.70:443 TCP packets 3.1 M bytes 4.2 G duration 1640 s
203.0.113.70:443 -> 10.8.3.44:50311 TCP packets 1.4 M bytes 61 M duration 1640 s
The workstation sent about 4.2 GB to one external address in 27 minutes and received only 61 MB, mostly acknowledgments. Uploads that dwarf downloads, to a single destination, at an hour when nobody is working, are the classic flow signature of data exfiltration. A different host making a 3 KB connection to the same address every 300 seconds, around the clock, suggests command-and-control beaconing. Many tiny flows from one source to hundreds of addresses or ports point to scanning, and workstations opening SMB (445) or RDP (3389) connections to other workstations suggest lateral movement.
What NetFlow cannot show
Flow data has no content. It can't show which file was uploaded, which URL was requested, what commands an attacker typed or which user was signed in, and that is true whether the traffic was encrypted or not. Many exporters also sample traffic, recording one packet in 100 or 1,000, which turns byte counts into estimates and can miss very short connections. Its strength is scale: a record is tiny compared with the packets it describes, so organizations can keep months of flow history, and it works as well for encrypted traffic as for cleartext.
NetFlow vs. packet capture vs. SNMP
| Tool | What it records | Typical retention |
|---|---|---|
| NetFlow / IPFIX | Metadata per conversation: addresses, ports, times, volume | Weeks to months |
| Packet capture | Every packet, including payload | Hours to days |
| SNMP | Device status and counters, such as interface utilization | Set by the monitoring system |
SNMP can tell you an interface is busy, NetFlow tells you which hosts are making it busy, and a packet capture tells you what they are sending.
NetFlow on the CompTIA Security+ exam
On SY0-801, NetFlow appears in objective 4.4, as one of the protocols used to monitor networks and generate alerts, and in objective 4.8, as a data source that supports an investigation. Scenario wording such as "which host sent the most data," "unusual volume to an external address," "connections to the same IP every 60 seconds" or "who communicated with this address over the past month" points to NetFlow or IPFIX, and the two are interchangeable answers. The usual distractor is packet capture: if the question needs the contents of traffic, such as a file name, a DNS query or a command, NetFlow is wrong because it records no payload. SNMP is the other trap, since it reports device health and counters, not conversations between hosts.