What is obtained using NetFlow?

NetFlow is a Cisco protocol used to collect IP operational metadata as traffic enters or exits an interface. It aggregates packets into "flows," where a flow is a unidirectional sequence of packets sharing common characteristics such as source/destination IP address, source/destination port, and protocol type. The exported NetFlow record contains summary information about this flow, including byte and packet counts, timestamps, and other metadata. This summary information is effectively session data, providing insight into network conversations without capturing the full payload of the packets.

B. application logs: These are generated by applications running on endpoints (e.g., web server access logs), not by network infrastructure monitoring traffic flows.

C. network downtime report: This is an operational status report. While a lack of NetFlow data could imply downtime, NetFlow's primary function is to report on traffic characteristics, not availability.

D. full packet capture: This involves capturing the entire contents (header and payload) of every packet. NetFlow is fundamentally different, as it only collects and exports metadata summaries of traffic flows.

1. Cisco Press

Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide

1st Edition.

Chapter 10

Network Intrusion Analysis

Section: "NetFlow": "NetFlow is a Cisco technology that provides the ability to collect detailed information about IP traffic that is flowing through a router or switch... NetFlow does not capture the contents (payload) of the packets. It only captures information about the packets

such as the source and destination IP addresses

source and destination ports

and the protocol." This description aligns directly with the concept of session data.

2. Cisco

Cisco IOS NetFlow Version 9 Flow-Record Format

White Paper.

Section: "Introduction to Cisco IOS NetFlow": "A flow is a unidirectional sequence of packets between a given source and destination... NetFlow provides valuable information about network users and applications

peak usage times

and traffic routing." This document defines a flow and its purpose

which is to summarize conversations (sessions).

3. Cisco

NetFlow Configuration Guide

Cisco IOS Release 15M&T.

Chapter: "Configuring NetFlow and NetFlow Data Export"

Section: "NetFlow Fundamentals": "NetFlow provides statistics on packets flowing through the router. It is emerging as a primary network accounting and security technology." The guide details the fields exported in a NetFlow record

all of which are metadata components of a session (e.g.

IP addresses

ports

protocol

ToS

packet/byte counts).