Introduction In modern network operations, what you can’t see can hurt you. Bandwidth hogs, silent DDoS attacks, lateral threat movement, and misconfigured routing protocols all leave traces in the traffic metadata. However, examining every packet via a full packet capture (PCAP) is expensive and often impractical for long-term retention. This is where NetFlow (and its variants: sFlow, IPFIX, J-Flow) and, more importantly, the NetFlow Collection Engine become indispensable.
| Protocol | Typical Export | Key Characteristics | |----------|----------------|----------------------| | | UDP | Fixed format, IPv4 only. Still widely used on legacy hardware. Lacks templates. | | NetFlow v9 | UDP | Template-based, supports IPv6, MPLS, and custom fields. Foundation for IPFIX. | | IPFIX | UDP/TCP/SCTP | IETF standard (RFC 7011-7015). Essentially NetFlow v9 with enterprise-specific extensions and reliable transport options. | | sFlow | UDP | Packet sampling (not flow-based). A single datagram can contain multiple flow samples and counter samples. Different architecture. | | J-Flow / NetStream | UDP | Juniper and Huawei variants, typically v5 or v9 compatible. | netflow collection engine
IPFIX templates not recognized, records garbled. Cause: UDP loss of template datagram. Increase collector buffer or switch to TCP transport. Introduction In modern network operations, what you can’t
Random flow records have zero bytes/packets. Cause: Exporter sends flow expiry due to idle timeout before any data transfer (e.g., SYN-only flows). Filter them out. This is where NetFlow (and its variants: sFlow,