Network Flow (NetFlow/IPFIX)
Definition
A summary record of a network conversation, storing source IP, destination IP, source port, destination port, protocol, byte count, and timestamps, without the packet payload. Flow records are less granular than PCAP but are retained for longer periods and cover higher-volume networks.
- Formats
- NetFlow, IPFIX
- Data captured
- Source/destination IP, ports, protocol, bytes, timestamps
- Excludes
- Packet payload
- Advantage
- Longer retention on high-volume networks
Common questions
Why do investigators use flow records instead of full packet captures?+
Flow records are far smaller than packet captures, so they can be retained for months on high-traffic networks where storing every packet would be impractical.
What can flow data not show that a packet capture can?+
The actual content exchanged, such as file contents, credentials, or message text, since flow records store only metadata describing the conversation.
Related terms
- Beaconing
- Periodic outbound connections from a compromised host to a command-and-control server, typically at regular intervals. The regularity of the interval, measured in...
- DNS Tunnelling
- Encoding data inside DNS queries and responses to exfiltrate information or carry command-and-control traffic through a network that permits DNS but blocks...
- Packet Capture (PCAP)
- The interception and recording of network packets as they traverse an interface. The raw data is stored in PCAP format and analysed...
- Port Number
- A 16-bit integer in the TCP or UDP header that identifies the application-layer service at each endpoint. Well-known ports are assigned by...
- TCP Three-Way Handshake
- The connection establishment sequence in TCP: the client sends SYN, the server responds SYN-ACK, and the client completes with ACK. The timestamps...