📖 What is NetFlow?
NetFlow is a network protocol developed by Cisco for collecting IP network traffic as it enters or exits an interface. It provides a summary of traffic flows, including source/destination IP addresses and ports, rather than capturing the full packet payload.
"Do not confuse NetFlow with PCAP. NetFlow is the 'phone bill' (who called whom), while PCAP is the 'recording' of the actual call."
📚 Certification: CompTIA Cybersecurity Analyst+ (CS0-003)
🔑 What are the Key Concepts of NetFlow?
- ▸ A flow is defined by a 5-tuple: source IP, destination IP, source port, destination port, and the IP protocol used for communication.
- ▸ NetFlow focuses on metadata rather than payloads, significantly reducing storage requirements and processing overhead compared to full packet captures (PCAP).
- ▸ It is primarily used for network baselining, identifying traffic anomalies, and detecting volumetric attacks like DDoS by analyzing traffic volume and patterns.
- ▸ The architecture consists of an exporter, which collects the flow data on the device, and a collector, which aggregates and analyzes it.
🎯 How does NetFlow appear on the CS0-003 Exam?
You may be asked to select the most efficient method for monitoring high-bandwidth backbone links to detect data exfiltration patterns without overwhelming storage systems with full packet captures, making NetFlow the ideal choice.
A scenario might describe a volumetric DDoS attack where you need to identify the top talkers and source IP distributions quickly to implement a blocklist at the perimeter without analyzing individual packet payloads.
❓ Frequently Asked Questions
How does NetFlow assist in detecting a 'low and slow' data exfiltration attack?
By analyzing flow records over time, analysts can identify persistent, small-volume connections to an external IP that deviate from the established baseline, even if the individual packets seem harmless.
Is NetFlow only available on Cisco hardware?
While developed by Cisco, the concept is industry-standard. Other vendors provide similar implementations, such as J-Flow (Juniper) or sFlow, which serve the same general purpose of flow-based monitoring.