NetFlow, sFlow, IPFIX: Monitoring and Flow Analytics

NetFlow (Cisco, 1996), sFlow (HP/InMon, 2001), and IPFIX (IETF standard, 2013) are network flow monitoring protocols. They are essential for traffic analysis, anomaly detection, ISP billing, and security (Zeek/Bro, StealthWatch). This comprehensive guide covers differences, deployment, collectors, and 2026 use cases.

NetFlow (Cisco)

• v5: legacy, 7 fixed fields, IPv4 only
• v9: configurable templates, IPv6, MPLS
• v10 (IPFIX, IETF standard): supersedes v9
• Flex NetFlow: new Cisco architecture with customizable fields
• Sampled: 1:N packets are analyzed (reduces CPU load)

sFlow (HP/InMon, Arista, Juniper)

• Always sampled (1:N, e.g., 1:1000)
• More lightweight than NetFlow (lower switch CPU usage)
• Supports L2 traffic (MAC/VLAN)
• Less accurate than NetFlow for short flows
• Recommended sampling rate: 1:100 (campus) to 1:10000 (DC)

IPFIX (IETF standard)

• RFC 7011 (2013)
• Standardized successor to NetFlow v9
• Flexible templates (flexible export)
• Multi-vendor (Cisco, Juniper, Arista, Nokia, Huawei)
• Bi-flow support: combines flows A→B and B→A into 1 record

Typical fields (flow key)

• src-ip / dst-ip
• src-port / dst-port
• protocol (TCP=6, UDP=17, ICMP=1)
• tos (DSCP)
• input-interface / output-interface
• packets / bytes
• start/end timestamps
• TCP flags (SYN, ACK, FIN, RST)

Cisco Flex NetFlow Configuration

• flow record R-BASIC
• match ipv4 source address
• match ipv4 destination address
• match transport source-port
• match transport destination-port
• match ipv4 protocol
• collect counter bytes
• collect counter packets
• flow exporter E-COLLECTOR
• destination 10.0.0.50
• transport udp 2055
• flow monitor M-BASIC
• record R-BASIC
• exporter E-COLLECTOR
• interface Gi1/0/1
• ip flow monitor M-BASIC input

Juniper sFlow Configuration

• set protocols sflow sample-rate ingress 100
• set protocols sflow collector 10.0.0.50 udp-port 6343
• set protocols sflow interfaces ge-0/0/0 rate 100
• set protocols sflow polling-interval 20

Popular Collectors

• SolarWinds NTA (NetFlow Traffic Analyzer): commercial, integrated with Orion
• PRTG: commercial, straightforward for SMBs
• ManageEngine NetFlow Analyzer: commercial
• ntopng: open source, powerful
• Elastiflow (ELK stack): open source, scalable
• Akvorado (free, modern, 2024): IPFIX + sFlow, ClickHouse data lake
• Cisco StealthWatch / Secure Network Analytics: SIEM-grade security
• Kentik: cloud-based, a leader for large enterprises

Monitoring Use Cases

• Top talkers: users/apps consuming the most bandwidth
• WAN saturation: identify flows that are saturating a link
• Capacity planning: analyze traffic trends over 6-12 months
• Anomaly detection: sudden changes in patterns
• Application analytics: determine what percentage of traffic is SaaS, Internet, or intra-DC
• ISP billing (outbound traffic per customer)

Security Use Cases

• DDoS detection: abnormal traffic volume on a dst port
• Data exfiltration: abnormal outbound transfer (5 GB at 3 a.m.)
• Lateral movement: an internal host scanning other hosts
• C2 beaconing: regular short connections to a suspicious IP address
• Compromise detection: top new IP addresses contacted by endpoints

Limitations

• L3/L4 visibility only (no L7 application visibility without DPI)
• Sampling reduces accuracy for small flows
• Switch CPU overhead (typically 10-20%)
• Storage: 1 Gbps WAN = ~50 GB/day of non-sampled flows

Order from OPTINOC

NetFlow/sFlow/IPFIX deployment on Cisco/Juniper/Arista with a collector (StealthWatch, Elastiflow, Akvorado). SIEM integration. Quote within 48 hours.