Home > Articles > NetFlow for Cybersecurity

NetFlow for Cybersecurity

Chapter Description

In this sample chapter from CCNA Cyber Ops SECOPS 210-255 Official Cert Guide, readers learn how to configure basic NetFlow in a Cisco device. Content also covers the industry standard IPFIX as well as how NetFlow is used for cybersecurity and incident response.

Foundation Topics

Introduction to NetFlow

NetFlow is a Cisco technology that provides comprehensive visibility into all network traffic that traverses a Cisco-supported device. Cisco invented NetFlow and is the leader in IP traffic flow technology. NetFlow was initially created for billing and accounting of network traffic and to measure other IP traffic characteristics such as bandwidth utilization and application performance. NetFlow has also been used as a network-capacity planning tool and to monitor network availability. NetFlow is used by many cybersecurity professionals as a network security tool because its reporting capabilities provide nonrepudiation, anomaly detection, and investigative capabilities. As network traffic traverses a NetFlow-enabled device, the device collects traffic flow information and provides a network administrator or security professional with detailed information about such flows.

NetFlow provides detailed network telemetry that allows the administrator to do the following:

  • See what is actually happening across the entire network.

  • Identify DoS attacks.

  • Quickly identify compromised endpoints and network infrastructure devices.

  • Monitor network usage of employees, contractors, or partners.

  • Obtain network telemetry during security incident response and forensics.

  • Detect firewall misconfigurations and inappropriate access to corporate resources.

NetFlow supports both IP version 4 (IPv4) and IP version 6 (IPv6), and it plays a crucial role in the following:

  • Network planning

  • Network security

  • Network troubleshooting

  • Traffic engineering

What Is a Flow in NetFlow?

A flow is a unidirectional series of packets between a given source and destination. In a flow, the same source and destination IP addresses, source and destination ports, and IP protocol are shared. This is often referred to as the 5-tuple. Figure 4-1 shows an example of a flow between a client and a server.

Figure 4-1

Figure 4-1 Basic NetFlow Example

In Figure 4-1, the client (source) establishes a connection to the server (destination). When the traffic traverses the router (configured for NetFlow), it generates a flow record. At the very minimum, the 5-tuple is used to identify the flow in the NetFlow database of flows kept on the device. This database is often called the NetFlow cache.

Table 4-2 shows the 5-tuple for the basic flow represented in Figure 4-1.

Table 4-2 NetFlow 5-Tuple

Flow Record Field


Source IP address

Destination IP address

Source port


Destination port




Depending on the version of NetFlow, the router can also gather additional information, such as type of service (ToS) byte, differentiated services code point (DSCP), the device’s input interface, TCP flags, byte counters, and start and end times.

Flexible NetFlow, Cisco’s next-generation NetFlow, can track a wide range of Layer 2, IPv4, and IPv6 flow information, such as the following:

  • Source and destination MAC addresses

  • Source and destination IPv4 or IPv6 addresses

  • Source and destination ports

  • ToS

  • DSCP

  • Packet and byte counts

  • Flow timestamps

  • Input and output interface numbers

  • TCP flags and encapsulated protocol (TCP/UDP) and individual TCP flags

  • Sections of a packet for deep packet inspection

  • All fields in an IPv4 header, including IP-ID and TTL

  • All fields in an IPv6 header, including Flow Label and Option Header

  • Routing information, such as next-hop address, source autonomous system number (ASN), destination ASN, source prefix mask, destination prefix mask, Border Gateway Protocol (BGP) next hop, and BGP policy accounting traffic index

NetFlow protocol data units (PDUs), also referred to as flow records, are generated and sent to a NetFlow collector after the flow concludes or expires (times out).

The NetFlow Cache

There are three types of NetFlow cache:

  • Normal cache: This is the default cache type in many infrastructure devices enabled with NetFlow and Flexible NetFlow. The entries in the flow cache are removed (aged out) based on the configured timeout active seconds and timeout inactive seconds settings.

  • Immediate cache:

    • Flow accounts for a single packet

    • Desirable for real-time traffic monitoring and distributed DoS (DDoS) detection

    • Used when only very small flows are expected (for example, sampling)

  • Permanent cache:

    • Used to track a set of flows without expiring the flows from the cache.

    • The entire cache is periodically exported (update timer).

    • The cache is a configurable value.

    • After the cache is full, new flows will not be monitored.

    • Uses update counters rather than delta counters.

Many people often confuse a flow with a session. All traffic in a flow is unidirectional; however, when the client establishes the HTTP connection (session) to the server and accesses a web page, this represents two separate flows. The first flow is the traffic from the client to the server, and the other is the return flow from the server to the client.

3. NetFlow Versions | Next Section Previous Section

There are currently no related articles. Please check back later.