- [Narrator] Net flow was originally created by Cisco.
It provides comprehensive visibility into network traffic
when it traverses a network supported device.
The original use for net flow
was for billing and accounting purposes.
For instance, during the dark ages
of dial-up internet access,
it was used to account for bandwidth
in dial-up utilization.
With the evolution of net flow,
it now brings along the capability to be utilized
as a tool for network visibility and security.
Let's take a quick look at how net flow works.
Here, you have device A and device B,
in between, you have a switch A and switch B
as well as router A.
when a packet traverses from device A to B
it touches each of these devices.
If these devices are capable of net flow
they will record a flow record for this transaction.
One out the inbound and one for the return traffic
it's like a phone call record.
A flow is considered a unidirectional series of packets
between a given source and a destination.
With each flow, the source and destination IP address
is recorded as well as the source and destination ports
and protocol.
This is referred to as the five tuple.
The five tuple is depicted here in the graphic.
There are many versions of net flow used
in the industry today
however, not all of them are useful for security visibility.
The internet flow information export or IPFIX
is a net flow standard led by the IETF.
The purpose of IPFIX
was to create a common universal standard of export
for flow information from routers, switches
and other infrastructure devices.
IPFIX is documented in RFC 7011 through 7015
as well as RFC 5103.
Cisco Net flow Version 9 is what IPFIX was based on.
Note that IPFIX records are exported via UDP messages.