Everything about NetFlow
Communications protocol
NetFlow is a feature that was introduced on Cisco routers around 1996 that provides the ability to collect IP network traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can determine things such as the source and destination traffic, class of service, and the causes of congestion. A typical flow monitoring setup consists of three main components:Flow exporter: aggregates packets into flows and exports flow records towards one or more flow collectors. Flow collector: responsible for reception, storage and pre-processing of flow data received from a flow exporter. Analysis application: analyzes received flow data in the context of intrusion detection or traffic profiling, for example. Wikipedia →
🧭 Start here: a 6-step reading path
- Read the overview: NetFlowA 5-minute orientation
- Skim a recent paper: NFIoT-GATE-DTL IDS: Genetic algorithm-tuned ensemble of deep transfer learning for NetFlow-based intrusion detection system for internet of thingsInfluential work since 2022
- Pick up a classic book: Network Security with NetFlow and IPFIXThe most-reprinted book on the subject
- Read the landmark paper: Flow Monitoring Explained: From Packet Capture to Data Analysis With NetFlow and IPFIXCited 381 times
- Go sideways: IP Flow Information ExportA closely related topic
- Go sideways: TracerouteA closely related topic
📖 Definitions
No dictionary entry for this exact phrase.
🗂️ The subject at a glance
🏆 Landmark papers (most cited)
Flow Monitoring Explained: From Packet Capture to Data Analysis With NetFlow and IPFIX
Building a better NetFlow
Intrusion detection system for large-scale IoT NetFlow networks using machine learning with modified Arithmetic Optimization Algorithm
Analysis of the impact of sampling on NetFlow traffic classification
SSH Compromise Detection using NetFlow/IPFIX
Anomaly detection in NetFlow network traffic using supervised machine learning algorithms
Examining the Suitability of NetFlow Features in Detecting IoT Network Intrusions
BotCluster: A session-based P2P botnet clustering system on NetFlow
🆕 Influential since 2022
NFIoT-GATE-DTL IDS: Genetic algorithm-tuned ensemble of deep transfer learning for NetFlow-based intrusion detection system for internet of things
ResDNViT: A hybrid architecture for Netflow-based attack detection using a residual dense network and Vision Transformer
Network Traffic Classification Based On A Deep Learning Approach Using NetFlow Data
Time Matters: Temporal NetFlow Features for ML-Based Network Intrusion Detection
Implementation and visualization of a netflow log data lake system for cyberattack detection using distributed deep learning
📚 Books worth reading
Network Security with NetFlow and IPFIXOmar Santos · 2015
Netflow at PisaG. Gallo · 1986- 📕Netflow at PisaGiorgio Gallo · 1986
Anomaly detection approach for detecting anomalies using netflow records and sparkDr. Rajkumar Khatri · 2017
Ranked by number of editions on Open Library, a rough measure of how lasting a book is.
🔗 Related topics
- IP Flow Information Export Internet Protocol Flow Information Export (IPFIX) is an IETF protocol, as well as the name of the IETF working group defining the protocol. It was created…
- Traceroute In computing, traceroute and tracert are diagnostic command-line interface commands for displaying possible routes (paths) and transit delays of packets…
- Network address translation Network address translation (NAT) is a method of mapping an IP address space into another by modifying network address information in the IP header of…
- Internet Control Message Protocol The Internet Control Message Protocol (ICMP) is a supporting protocol in the Internet protocol suite. It is used by network devices, including routers…
- Traffic flow (computer networking) In packet switching networks, traffic flow, packet flow or network flow is a sequence of packets from a source computer to a destination, which may be…
- SFlow sFlow, short for "sampled flow", is a standard for packet export at Layer 2 of the OSI model. sFlow was originally developed by InMon Corp. It provides…
- Routing Information Protocol The Routing Information Protocol (RIP) is one of the oldest distance-vector routing protocols which employs the hop count as a routing metric. RIP prevents…
- Network socket A network socket is a software structure within a network node of a computer network that serves as an endpoint for sending and receiving data across the…