NetFlow

Recording every single packet on a busy network is like keeping a photocopy of every letter in a city's post — accurate, but impossibly bulky. Often you do not need the contents at all; you just need to know who wrote to whom, how often, and how much. NetFlow is the network's way of keeping that lightweight ledger: instead of saving packets, a router groups them into flows and exports a short summary of each. It is bookkeeping, not eavesdropping.

A flow is all the packets that share the same key over a span of time — typically the same source and destination IP address, the same source and destination port, and the same protocol. As packets pass, the router maintains a small record per flow, tallying the packet count, the byte count, the start and end times, and a few flags. When the flow ends or a timer expires, the router exports that record to a collector, which stores and reports on it. The result is a compact, queryable history of who talked to whom and how much — at a tiny fraction of the storage that full packet capture would demand. IPFIX is the IETF-standardised successor to Cisco's NetFlow, and sFlow is a related approach based on packet sampling.

Understand what it does and does not give you. NetFlow records metadata — the headers and counts — not the payload, so it tells you that host A sent 4 GB to host B on port 443 but not what was in those bytes. To scale on fast links, most deployments sample, exporting one in every N packets, which makes totals statistical estimates rather than exact counts. It is the workhorse of traffic accounting, capacity planning, billing, and spotting anomalies like a sudden traffic spike or an unexpected destination — a passive, summary-level view, complementary to the byte-for-byte detail of packet capture.