📘CompTIA Security+ (SY0-701)
1. What Is NetFlow?
NetFlow is a Cisco technology used to collect and analyze network traffic information.
Instead of looking at every packet in detail, NetFlow summarizes traffic into flows.
A flow is a group of packets that share the same characteristics.
NetFlow answers questions such as:
- Who is communicating on the network?
- Which applications are being used?
- How much data is being transferred?
- When did communication start and end?
NetFlow is mainly used for:
- Network visibility
- Traffic monitoring
- Security analysis
- Troubleshooting
- Capacity planning
2. What Is a NetFlow Record?
A NetFlow record is a structured set of information that describes one flow.
Each record contains details about:
- Source and destination
- Protocol and ports
- Amount of data transferred
- Timing information
NetFlow records are created by network devices such as:
- Routers
- Switches
- Firewalls
3. Key Components of NetFlow
NetFlow has three main components. These are very important for the exam.
3.1 Flow Cache
- The flow cache exists on the network device
- It temporarily stores flow records
- Each entry represents one active flow
What happens:
- Packets enter the device
- The device checks if a matching flow already exists
- If yes → counters are updated
- If no → a new flow entry is created
Flows are removed from the cache when:
- The flow becomes inactive
- A timeout occurs
- The cache becomes full
3.2 Flow Exporter
- The flow exporter sends flow records to an external system
- Export is done using UDP
- Data is sent after flows expire or at configured intervals
Export details include:
- Destination IP (collector)
- UDP port number
- Export version (v5, v9, IPFIX)
3.3 Flow Collector
- The flow collector receives NetFlow records
- It is usually a server or security monitoring tool
- The collector stores, processes, and analyzes the data
Collectors are used by:
- SIEM systems
- Network monitoring tools
- Security analytics platforms
4. What Information Is in a NetFlow Record?
A traditional NetFlow record includes the following fields:
4.1 Basic Flow Identifiers (Five-Tuple)
This is very important for the exam.
- Source IP address
- Destination IP address
- Source port
- Destination port
- Protocol (TCP, UDP, ICMP)
These five fields uniquely identify a flow.
4.2 Traffic Statistics
- Number of packets
- Number of bytes
- Flow start time
- Flow end time
4.3 Network Details
- Input interface
- Output interface
- Type of Service (ToS)
- TCP flags (SYN, ACK, FIN, RST)
5. NetFlow Versions (Exam Focus)
You should know the difference at a high level.
5.1 NetFlow Version 5
- Fixed format
- Limited fields
- IPv4 only
- Not customizable
5.2 NetFlow Version 9
- Template-based
- Supports IPv4 and IPv6
- Allows customization
- Foundation for Flexible NetFlow
5.3 IPFIX
- Industry standard
- Based on NetFlow v9
- Used across different vendors
6. Limitations of Traditional NetFlow
Traditional NetFlow has several limitations:
- Fixed record format (v5)
- Limited visibility into applications
- Difficult to extend
- Not optimized for modern security needs
- Cannot easily track new protocols or custom fields
These limitations led to Flexible NetFlow.
7. What Is Flexible NetFlow (FNF)?
Flexible NetFlow (FNF) is an enhanced and modern version of NetFlow.
It allows administrators to:
- Customize what data is collected
- Define how flows are created
- Control how data is exported
Flexible NetFlow provides better security visibility and scalability.
8. Components of Flexible NetFlow
Flexible NetFlow is built using three core elements.
These are very important for the exam.
8.1 Flow Record
A flow record defines what information is collected.
It specifies:
- Match fields (how a flow is identified)
- Collect fields (what data is stored)
Match Fields (Used to Identify Flows)
Examples:
- Source IP
- Destination IP
- Source port
- Destination port
- Protocol
Collect Fields (Used to Store Data)
Examples:
- Byte count
- Packet count
- TCP flags
- Timestamps
- Application ID
8.2 Flow Exporter
The flow exporter defines:
- Where flow data is sent
- How it is sent
Includes:
- Collector IP address
- UDP port
- Export format (NetFlow v9 or IPFIX)
- Export timeout
8.3 Flow Monitor
A flow monitor ties everything together.
It:
- Applies the flow record
- Uses the flow exporter
- Is attached to an interface (input or output)
Without a flow monitor, Flexible NetFlow does not work.
9. How Flexible NetFlow Works (Simple Flow)
- Traffic enters an interface
- Flow monitor is applied
- Flow record matches traffic
- Data is collected as defined
- Flow exporter sends records to the collector
10. Capabilities of NetFlow and Flexible NetFlow
10.1 Traffic Visibility
- See who is talking to whom
- Identify top talkers
- Understand bandwidth usage
10.2 Application Awareness
Flexible NetFlow can:
- Identify applications
- Track application usage
- Support application-based security policies
10.3 Security Monitoring
NetFlow helps detect:
- Scanning behavior
- Unusual traffic patterns
- Data exfiltration attempts
- Command-and-control communication
10.4 Network Performance Monitoring
- Identify congested links
- Detect latency issues
- Support capacity planning
10.5 Customization and Scalability
Flexible NetFlow allows:
- Custom records
- Reduced overhead
- Better performance on large networks
11. Benefits of NetFlow and Flexible NetFlow
11.1 Improved Network Visibility
- Detailed view of network activity
- Works even with encrypted traffic (metadata only)
11.2 Enhanced Security Operations
- Supports threat detection
- Feeds SIEM and security analytics tools
- Helps with incident investigation
11.3 Reduced Packet Inspection Load
- Uses summarized data
- Less CPU and memory usage compared to full packet capture
11.4 Flexible and Future-Ready
- Supports new protocols
- Customizable records
- Suitable for modern enterprise and cloud networks
11.5 Vendor and Tool Integration
- Works with Cisco and third-party tools
- Supports IPFIX for standardization
12. NetFlow vs Flexible NetFlow (Quick Exam Comparison)
| Feature | NetFlow | Flexible NetFlow |
|---|---|---|
| Record Format | Fixed (v5) | Customizable |
| IPv6 Support | Limited | Full |
| Application Visibility | Limited | Advanced |
| Security Use Cases | Basic | Advanced |
| Scalability | Moderate | High |
13. Why NetFlow and Flexible NetFlow Matter for the 350-701 Exam
Cisco expects you to understand:
- What NetFlow is
- What information it collects
- How Flexible NetFlow improves it
- Why it is useful for security and monitoring
You do not need to configure it for the exam, but you must understand the concepts, components, capabilities, and benefits.
14. Key Exam Takeaways (Memorize These)
- NetFlow provides traffic visibility
- A flow is identified using the five-tuple
- NetFlow has flow cache, exporter, and collector
- Flexible NetFlow allows custom flow records
- Flow record + exporter + monitor = Flexible NetFlow
- NetFlow supports security, monitoring, and troubleshooting
