Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I hear these terms used a lot but haven't found a decent explanation of what they are, how they are used, and what the data looks like (e.g. can you view this data in wireshark?)?

share|improve this question

4 Answers 4

up vote 4 down vote accepted

Netflow is a protocol used by Cisco Routers/Switches that summarizes "seen" traffic and sends these summaries to a so-called Netflow Collector. IPFlow is a derivate which is independent of Cisco.

A Netflow Collector or Reporter (software) can then generate reports for this seen traffic.

Common answers given by this data are: - Which are the top protocols in my network (http, ftp,...) - Which hosts are talking the most to each other - Which are the overall top sending hosts - ...

See: - http://en.wikipedia.org/wiki/IP_Flow_Information_Export - http://en.wikipedia.org/wiki/Netflow

Also popular: sFlow. A technology by Juniper which has the same goal/motivation as Netflow but working slightly different (Forwarding samples to a collector).

Regarding Wireshark: Yes. You can see this traffic in Wireshark. Like any other traffic if it "passes" your capturing host.

share|improve this answer

Netflow is a protocol by Cisco to gather IP traffic information.

IPFlow is a netflow collector.

RFC for netflow 9 can be found at http://www.ietf.org/rfc/rfc3954.txt.

Wireshark has filter for Cisco NetFlow/IPFIX.

share|improve this answer

I would read wikipedia on NetFlow as outlined above.

By IPFLOW do you mean IPFIX? Here is a blog on NetFlow Vs. IPFIX. http://www.plixer.com/blog/netflow/what-is-ipfix-vs-netflow-v9/

Jake

share|improve this answer

Netflow is the name CISCO gave to the broader class of network traffic reporting formats, generally known as ‘flow reporting’. It is the equivalent of a ‘pen register’ for Internet traffic.

Flow analysis (reporting) allows one to see who communicated with whom, without digging into the content of the communication. This is helpful in many ways, as it helps pinpoint network bottlenecks, find the cause of slowdowns, and see the source of attacks or information leaks, all without doing extensive in-depth analysis.

It is also helpful to get a more macro-view of your network. Wireshark (and full packet capture) can be too much to handle on busy networks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.