Flow exporter: aggregates packets into flows and exports flow records towards one or more flow collectors.

These records are exported from the router and collected using a collector.Ī typical flow monitoring setup consists of three main components: Routers that have the this feature enabled generate NetFlow records.

Source and destination IP addresses exchanging information.

In more technical terms, a flow is defined by its 5-tuple, a collection of five data points:

Capacity planning: Tracking network usage to assess future bandwidth requirements.

Security analysis: Detecting changes in network behavior to identify network anomalies.

Monitoring: Monitoring network, tracking in and out traffic, and identifying top users.Validation of QoS parameters: appropriate bandwidth allocation to each Class of Service (CoS).Troubleshooting: Diagnosing and troubleshooting network slowdowns, bandwidth hogs, and traffic spikes.NetFlow data can be used for several network management tasks, such as: A flow refers to any connection or connection-like communication channel. When computers need to talk to one another they establish communication channels, commonly referred to as connections. Using a NetFlow collector and analyzer, a network manager can sees where network traffic is coming from and going to and how much traffic is being generated. Today, NetFlow has become a de-facto industry standard and is supported by platforms other than Cisco including Juniper (Jflow), 3Com/HP, Dell and Netgear (sFlow),Huawei (NetStream), Alcatel-Lucent (Cflow), and Ericsson (Rflow). For example, NetFlow captures the timestamp of a flow’s first and last packets (and hence its duration), the total number of bytes and packets exchanged, a summary of the flags used in TCP connections, and other details. NetFlow is a feature that was introduced on Cisco routers around 1996 that provides the ability to collect IP network traffic as it enters or exits an interface.

Solarwinds netflow collector