I hear these terms used a lot but haven't found a decent explanation of what they are, how they are used, and what the data looks like (e.g. can you view this data in wireshark?)?


Netflow is a protocol used by Cisco Routers/Switches that summarizes "seen" traffic and sends these summaries to a so-called Netflow Collector. IPFlow is a derivate which is independent of Cisco.

A Netflow Collector or Reporter (software) can then generate reports for this seen traffic.

Common answers given by this data are: - Which are the top protocols in my network (http, ftp,...) - Which hosts are talking the most to each other - Which are the overall top sending hosts - ...

See: - http://en.wikipedia.org/wiki/IP_Flow_Information_Export - http://en.wikipedia.org/wiki/Netflow

Also popular: sFlow. A technology by Juniper which has the same goal/motivation as Netflow but working slightly different (Forwarding samples to a collector).

Regarding Wireshark: Yes. You can see this traffic in Wireshark. Like any other traffic if it "passes" your capturing host.


Netflow is a protocol by Cisco to gather IP traffic information.

IPFlow is a netflow collector.

RFC for netflow 9 can be found at http://www.ietf.org/rfc/rfc3954.txt.

Wireshark has filter for Cisco NetFlow/IPFIX.


Netflow is the name CISCO gave to the broader class of network traffic reporting formats, generally known as ‘flow reporting’. It is the equivalent of a ‘pen register’ for Internet traffic.

Flow analysis (reporting) allows one to see who communicated with whom, without digging into the content of the communication. This is helpful in many ways, as it helps pinpoint network bottlenecks, find the cause of slowdowns, and see the source of attacks or information leaks, all without doing extensive in-depth analysis.

It is also helpful to get a more macro-view of your network. Wireshark (and full packet capture) can be too much to handle on busy networks.


I would read wikipedia on NetFlow as outlined above.

By IPFLOW do you mean IPFIX? Here is a blog on NetFlow Vs. IPFIX. http://www.plixer.com/blog/netflow/what-is-ipfix-vs-netflow-v9/


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.