In Network Monitoring, knowing that an interface is 100% utilized is helpful, but it doesn't solve the problem. You need to know who is using the bandwidth and what they are doing. This is where Network Flow Telemetry comes in, most commonly implemented via NetFlow or IPFIX.
Understanding the Monitoring Ecosystem
| Technology | What it Tells You |
|---|---|
| SNMP | "The Internet link is 100% full." (Device & Interface metrics) |
| Syslog | "An administrator logged in at 2 PM." (Events & Messages) |
| NetFlow / IPFIX | "Host 192.168.1.5 is downloading 50GB over HTTPS from 8.8.8.8." (Conversations) |
| Packet Capture | "Here is the exact data inside the packet." (Individual packets) |
What is a Flow?
A "flow" is a unidirectional sequence of packets that share a set of common characteristics. Think of it like a phone bill. A phone bill tells you who called whom, at what time, and for how many minutes. But it does not record the audio of the conversation.
Flow telemetry generally records:
- Source IP and Destination IP
- Source Port and Destination Port
- Layer 4 Protocol (e.g., TCP or UDP)
- Total Bytes and Total Packets transferred
- Timestamps (Start and End)
Flow data does not contain full packet payloads. You cannot use NetFlow to read someone's email or view the images they downloaded.
NetFlow vs IPFIX
- NetFlow: Originally developed by Cisco. NetFlow v5 is highly common but rigidly structured (only records basic IPv4 data). NetFlow v9 introduced "templates," allowing it to support IPv6 and custom fields.
- IPFIX (IP Flow Information Export): An IETF open standard heavily inspired by NetFlow v9. Because IPFIX is vendor-neutral and highly extensible, it is the modern standard for flow telemetry. (Note: Because IPFIX is template-based, not all devices will export the exact same fields.)
The Architecture
- Flow Exporter: The router or firewall examining the traffic passing through it. It aggregates the packet statistics into flow records and exports them periodically.
- Flow Collector: A centralized server that receives the UDP flow records (often on UDP Port 2055 or 4739) and stores them in a database.
- Flow Analyzer: The software dashboard where engineers run reports to find "Top Talkers," analyze application trends, or detect unusual traffic patterns (like a DDoS attack).
Common Troubleshooting
- Firewall Blocking Export: The router is generating flow records, but an intermediate firewall is dropping the UDP packets before they reach the collector.
- Interface Not Enabled: Flow telemetry usually must be explicitly enabled on a per-interface and per-direction (ingress/egress) basis. If you forget to apply it to the WAN interface, you will see no internet flows.
- Template Issues (NetFlow v9 / IPFIX): Because these protocols use templates, the collector must receive the template definition packet before it can decode the data packets. If the collector shows errors, it may be missing the template, or the router might be exporting a proprietary field the collector doesn't understand.
- Sampling Config: On massive 100Gbps links, routers cannot process every single packet. They use "Sampled NetFlow" (e.g., looking at 1 in every 1000 packets). If the collector is not configured with the correct sampling multiplier, traffic graphs will appear 1000 times smaller than reality.
Security & Privacy Note
While flow telemetry does not capture payloads, it records network communication metadata. In a corporate environment, this metadata reveals exactly which external services and internal servers users are communicating with. Flow databases should be strictly access-controlled and protected appropriately.