In which scenario would an investigator collect NetFlow logs rather than PCAP logs?

NetFlow is a network protocol that collects IP traffic metadata, summarizing data into "flows" rather than capturing the full content of every packet. This results in a significantly smaller data volume compared to full packet capture (PCAP). In scenarios where long-term data retention is required or storage resources are constrained, collecting NetFlow logs is a practical and efficient choice. It provides valuable high-level visibility into network communications (who is talking to whom, when, and for how long) without the immense storage overhead associated with PCAP.

B. For detailed network monitoring: PCAP provides the most granular level of detail, including packet payloads, making it superior for in-depth, "detailed" analysis.
C. For deep packet inspection: Deep packet inspection (DPI) requires analyzing the payload of packets, which is only possible with PCAP logs, not NetFlow.
D. To collect application layer data: Application layer data (e.g., HTTP headers, email content) resides within the packet payload, which NetFlow does not capture.

1. Cisco Systems, Inc. (2017). Cisco IOS NetFlow Version 9 Flow-Record Format. "NetFlow provides a key set of services for IP applications... NetFlow is becoming a key technology for a number of applications... The information that NetFlow provides can be used for network monitoring... without the overhead of collecting and analyzing the entire contents of the packets."

Reference: Cisco Public Information, "Cisco IOS NetFlow Version 9 Flow-Record Format," Document ID: 13729.

2. Hofstede, R., Čeleda, P., Trammell, B., & Drago, I. (2014). Flow-based intrusion detection. In N. B. D. Jaeger & J. M. A. G. d. B. e. C. M. (Eds.), Cyber-Physical Systems for Critical Infrastructure Security (pp. 119-158). "The main advantage of flow-based monitoring is the significant data reduction it provides. Instead of storing every packet, a flow cache aggregates packets into flows, and only exports flow records containing summary statistics."

DOI: https://doi.org/10.1002/9781118905531.ch5 (Specifically, Section 5.2, "Flow-based Monitoring").

3. Lunt, B. M. (2016). Network Traffic Analysis. In Guide to Network Defense and Countermeasures (3rd ed., pp. 209–244). Cengage Learning. The text distinguishes between full packet capture and flow data, noting that flow data (like NetFlow) is a summary that is "much smaller than the original traffic" and is used for identifying trends and anomalies, whereas full packet capture is used for deep analysis but requires "massive amounts of storage."

Reference: Chapter 6, Section "Flow Analysis," p. 228.