How is NetFlow different from traffic mirroring?

The fundamental difference between NetFlow and traffic mirroring lies in the type of data they provide. NetFlow is a telemetry protocol that collects metadata about IP traffic flows. It creates summary records that include details like source/destination IP addresses, ports, protocol, packet/byte counts, and timestamps, but not the actual packet payload. Conversely, traffic mirroring, implemented via features like Cisco's Switched Port Analyzer (SPAN), creates a bit-for-bit copy (clone) of the entire data packet, including the payload. This allows for deep packet inspection and content analysis, whereas NetFlow is used for traffic accounting, security analysis based on communication patterns, and network performance monitoring.

B. Both technologies consume system resources. High traffic volumes can cause significant CPU load for both NetFlow cache management and SPAN packet replication.
C. Traffic mirroring often incurs higher operational costs due to the massive storage and powerful analysis tools required to process full packet captures.
D. NetFlow generates significantly less data than traffic mirroring because it sends compact summary records, while mirroring duplicates every single packet.

1. Cisco Press

Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide

Chapter 13

"Network Monitoring and Analysis"

Section "NetFlow". The text states

"NetFlow is a Cisco technology that provides statistics on packets flowing through a router or multilayer switch." In contrast

the section "Port Mirroring" describes SPAN as a feature that enables you to "mirror traffic from one or more source ports... to a destination port." This highlights the distinction between statistics (metadata) and mirrored traffic (cloned data).

2. Cisco Systems

Introduction to Cisco IOS NetFlow - A Technical Overview

Document ID: 13632

"What is NetFlow?" section. This document specifies that a NetFlow record contains information such as "Source and destination IP address

" "Source and destination TCP/UDP port numbers

" and "Packet and byte counts." It makes no mention of capturing packet payloads

confirming it collects metadata.

3. Cisco Systems

Catalyst 9300 Series Switches

Cisco IOS XE... System Management Configuration Guide

"Configuring SPAN and RSPAN" chapter. The guide states

"SPAN mirrors traffic received or sent... on one or more source ports... to a destination port for analysis." The term "mirrors traffic" explicitly means it copies the actual packets

which is a clone of the data.