Editing NetFlow (section)

{{Short description|Communications protocol}}
'''NetFlow''' is a feature that was introduced on [[Cisco]] routers around 1996 that provides the ability to collect IP network traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can determine things such as the source and destination traffic, class of service, and the causes of congestion. A typical flow monitoring setup (using NetFlow) consists of three main components:<ref name="Flow_Monitoring_Tutorial">{{cite journal
| last1  = Hofstede | first1 = Rick
| last2 = Čeleda   | first2 = Pavel
| last3 = Trammell | first3 = Brian
| last4        = Drago
| first4       = Idilio
| last5        = Sadre
| first5       = Ramin
| last6        = Sperotto
| first6       = Anna
| last7        = Pras
| first7       = Aiko
| title        = Flow Monitoring Explained: From Packet Capture to Data Analysis with NetFlow and IPFIX
| url          = http://porto.polito.it/2658703/
| journal      = IEEE Communications Surveys & Tutorials
| volume       = 16
| issue        = 4
| pages        = 2037–2064
| doi          = 10.1109/COMST.2014.2321898
| year = 2014
| s2cid = 14042725
}}</ref>

* '''Flow exporter''': aggregates packets into flows and exports flow records towards one or more flow collectors.
* '''Flow collector''': responsible for reception, storage and pre-processing of flow data received from a flow exporter.
* '''Analysis application''': analyzes received flow data in the context of intrusion detection or traffic profiling, for example.