NetFlow analysis

NetFlow analysis examines summarized records of network traffic, source and destination addresses, ports, protocol, byte and packet counts, exported by routers and switches, to understand traffic patterns without capturing full packet contents. NetFlow is Cisco's original protocol; IPFIX is the vendor-neutral standard that evolved from it, and both are analyzed the same way.

Flow analysis differs from full packet capture in that it records metadata about a conversation rather than its contents, which is far cheaper to store and process at scale but cannot reveal what was inside the traffic, only who talked to whom, how much, and for how long. It complements network latency and packet loss measurements, which describe performance quality, by describing traffic volume and direction instead.

NetFlow analysis matters for both capacity planning, spotting which links or services drive the most traffic, and security investigations, where unusual flow patterns, such as a server suddenly sending large volumes of data to an unfamiliar external address, can be an indicator of compromise worth escalating to a SIEM. A common pitfall is sampling flow records too aggressively to save cost, which can miss short-lived but significant connections entirely.