SNMP tells you how much traffic crossed an interface; NetFlow tells you what that traffic was: who talked to whom, on which ports, how many packets and bytes. A flow is a set of packets sharing the same key fields, classically source and destination IP, source and destination port, protocol, type of service and input interface. The device tracks each flow in a cache and exports summarized records to a collector for analysis. NetFlow is used for capacity planning, application visibility, billing, and security, such as detecting scans, data exfiltration or unusual traffic patterns.
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 6 more sections, 5 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.