NetFlow, sFlow and IPFIX: A Practical Guide to Traffic Flow Analysis
Interface counters tell you a link is busy. Flow data tells you why. NetFlow, sFlow and IPFIX export summaries of network conversations — source, destination, ports, protocol and volume — so you can see exactly what is consuming capacity.
NetFlow, sFlow and IPFIX in brief
- NetFlow: originally Cisco’s format, records flows tracked by the device.
- IPFIX: the IETF standard based on NetFlow v9, flexible and vendor-neutral.
- sFlow: samples packets at a fixed rate, lightweight and well suited to high-speed switches.
What you can do with flow data
- Capacity planning: identify top talkers and growth trends per site or customer.
- Troubleshooting: find the backup job or update storm causing congestion.
- Security: detect scanning, DDoS, data exfiltration and botnet traffic.
- Peering and transit (ISPs): see which networks your traffic flows to and optimise interconnects.
- Billing and chargeback: allocate usage to departments or customers.
Deployment tips
- Export from edge and core routers where traffic enters and leaves your network.
- Choose sampling rates that balance accuracy and device load.
- Enrich flows with interface names, sites and BGP data.
- Retain enough history for trend analysis and investigations.
Ubixe Infotech deploys flow collection and analytics for enterprises and ISPs. See our Traffic Flow Analysis service or request a demo.
