Which data format is the most efficient to build a baseline of traffic seen over an extended period of time?

NetFlow is the most efficient data format for long-term traffic baselining. It is a protocol that collects, aggregates, and exports metadata about IP traffic flows—not the entire content of every packet. This metadata includes key identifiers like source/destination IP addresses, ports, protocol type, and volume metrics such as byte and packet counts. By summarizing traffic into flow records, NetFlow significantly reduces the amount of data that needs to be stored and analyzed compared to full packet capture. This efficiency is crucial for building a statistical baseline of normal network behavior over an extended period.

A. syslog messages: Syslog reports discrete device events (e.g., interface status, login failures) and does not provide the aggregated traffic volume and flow data required for a comprehensive baseline.
B. full packet capture: This method captures every bit of every packet, including the payload. It is extremely resource-intensive and generates massive files, making it impractical and inefficient for long-term baselining.
D. firewall event logs: These logs record actions taken by a firewall (e.g., permit, deny) on traffic hitting its rule sets, offering an incomplete picture of overall network traffic patterns.

1. Odom

W. (2019). CCNA 200-301 Official Cert Guide

Volume 2. Cisco Press.

Chapter 26

"Network Management Protocols

" Section "NetFlow." The text explains that NetFlow gathers "information about the data flowing through the network

" including details like IP addresses

ports

and "the total number of bytes of the packets in the flow." This statistical data is the foundation of a traffic baseline

and the protocol is designed to collect it efficiently.

2. Cisco. (2021). Flexible NetFlow Configuration Guide

Cisco IOS XE Amsterdam 17.6.x.

Chapter: "Overview of Cisco IOS Flexible NetFlow

" Section: "Finding Network Problems Using Cisco IOS Flexible NetFlow." The guide states

"NetFlow provides information about network users and applications

peak usage times

and traffic routing." These capabilities are fundamental to creating a baseline of network activity for anomaly detection and capacity planning. It highlights NetFlow's role in providing a "macro-level view."

3. Dainotti

A.

Pescape

A.

& Claffy

K. (2012). Issues and future directions in traffic classification. IEEE Network

26(1)

35-40.

Section II

"TRAFFIC CLASSIFICATION: STATE OF THE ART." This peer-reviewed article discusses traffic analysis techniques

contrasting packet-level inspection with flow-level analysis (like NetFlow). It notes that flow-based measurement "reduces the amount of data to be stored and processed

" which directly addresses the efficiency required for long-term baselining mentioned in the question. (DOI: https://doi.org/10.1109/MNET.2012.6135854)