Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I hear these terms used a lot but haven't found a decent explanation of what they are, how they are used, and what the data looks like (e.g. can you view this data in wireshark?)?

share|improve this question
up vote 4 down vote accepted

Netflow is a protocol used by Cisco Routers/Switches that summarizes "seen" traffic and sends these summaries to a so-called Netflow Collector. IPFlow is a derivate which is independent of Cisco.

A Netflow Collector or Reporter (software) can then generate reports for this seen traffic.

Common answers given by this data are: - Which are the top protocols in my network (http, ftp,...) - Which hosts are talking the most to each other - Which are the overall top sending hosts - ...

See: - -

Also popular: sFlow. A technology by Juniper which has the same goal/motivation as Netflow but working slightly different (Forwarding samples to a collector).

Regarding Wireshark: Yes. You can see this traffic in Wireshark. Like any other traffic if it "passes" your capturing host.

share|improve this answer

Netflow is a protocol by Cisco to gather IP traffic information.

IPFlow is a netflow collector.

RFC for netflow 9 can be found at

Wireshark has filter for Cisco NetFlow/IPFIX.

share|improve this answer

I would read wikipedia on NetFlow as outlined above.

By IPFLOW do you mean IPFIX? Here is a blog on NetFlow Vs. IPFIX.


share|improve this answer

Netflow is the name CISCO gave to the broader class of network traffic reporting formats, generally known as ‘flow reporting’. It is the equivalent of a ‘pen register’ for Internet traffic.

Flow analysis (reporting) allows one to see who communicated with whom, without digging into the content of the communication. This is helpful in many ways, as it helps pinpoint network bottlenecks, find the cause of slowdowns, and see the source of attacks or information leaks, all without doing extensive in-depth analysis.

It is also helpful to get a more macro-view of your network. Wireshark (and full packet capture) can be too much to handle on busy networks.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.