# NetFlow Analysis
NetFlow is a network protocol originally developed by Cisco Systems for collecting IP traffic information and monitoring network flow data. Unlike packet capture, which records entire network conversations, NetFlow creates summaries of network sessions called flow records. A flow is defined as a unidirectional sequence of packets that share seven key characteristics: source IP address, destination IP address, source port, destination port, IP protocol type, ingress interface, and Type of Service (ToS) byte.
NetFlow exists because organizations need visibility into their network traffic patterns without the storage overhead and privacy concerns of full packet capture. A single flow record can represent thousands of packets in a long-running connection, providing network administrators and security analysts with the essential information about who is talking to whom, when, and how much data is being transferred.
NetFlow analysis fits into network security monitoring as a foundational capability for understanding baseline network behavior, detecting anomalous traffic patterns, and investigating security incidents. Flow data reveals the metadata of network communications, which often contains more useful information for threat detection than the actual content of those communications. This makes NetFlow particularly valuable in environments where encrypted traffic predominates, since the encryption renders payload analysis ineffective but leaves flow patterns intact and observable.
The protocol has evolved significantly since its introduction in the 1990s. Modern NetFlow implementations support IPv6, MPLS labeling, application identification, and custom fields through flexible template-based formats. The Internet Engineering Task Force (IETF) standardized the approach as IP Flow Information Export (IPFIX) in RFC 7011, though Cisco's NetFlow variants remain widely deployed.
NetFlow-enabled network devices, including routers, switches, firewalls, and dedicated flow probes, observe packets traversing their interfaces and aggregate them into flow records based on the seven-tuple flow definition. The device maintains a flow cache in memory where it stores active flows and updates statistics as additional packets arrive that match existing flows.
Flow expiration occurs through three primary mechanisms. Inactive timeout expires flows that have not seen new packets within a specified time period, typically 15 seconds for TCP and 30 seconds for UDP. Active timeout expires long-running flows after a maximum duration, usually 30 minutes, to ensure that flow records are exported regularly even for persistent connections. Protocol-specific termination occurs when the device observes TCP FIN or RST packets that indicate the natural end of a TCP session.
When a flow expires, the network device exports the flow record to one or more NetFlow collectors using UDP transport. The collector receives these flow records, stores them in a database or time-series data store, and makes them available for analysis platforms and security tools.
NetFlow v5, the most widely supported legacy version, exports fixed-format records containing source and destination IP addresses, source and destination ports, IP protocol, input interface index, byte count, packet count, flow start time, flow end time, TCP flags, and ToS byte. Each NetFlow v5 record is exactly 48 bytes, and up to 30 records can be packed into a single UDP export packet.
NetFlow v9 introduced template-based exports that allow network devices to define custom record formats. Templates are transmitted periodically to inform collectors about the structure of subsequent flow records. This flexibility enables NetFlow v9 to support IPv6 addresses, MPLS labels, application identification through Deep Packet Inspection (DPI), and vendor-specific fields. Template-based exports require more sophisticated collector implementations but provide significantly more detailed flow information.
IPFIX, defined in RFC 7011, is the IETF standardization of NetFlow v9 concepts with additional features for enterprise and service provider environments. IPFIX supports variable-length fields, which is particularly important for application signatures and URL information. It also defines transport over TCP and SCTP in addition to UDP, providing reliable delivery for critical flow information.
Modern network devices often include application visibility capabilities that classify flows by application type rather than just port numbers. This Application Visibility and Control (AVC) or Deep Packet Inspection (DPI) functionality examines packet headers and initial payload bytes to identify applications like Skype, BitTorrent, or custom enterprise applications, even when they use non-standard ports or attempt to masquerade as other protocols.
NetFlow collectors aggregate flow data from multiple sources and typically provide correlation capabilities across network devices. Enterprise collector platforms like SolarWinds NetFlow Traffic Analyzer, Plixer Scrutinizer, and open-source tools like nfcapd process millions of flow records per minute and provide storage, indexing, and query capabilities for historical analysis.
Analysis platforms consume flow data from collectors and provide visualization, alerting, and investigation capabilities. These platforms establish baselines of normal network behavior, detect statistical anomalies, and provide drill-down capabilities for incident investigation. Advanced platforms incorporate machine learning algorithms to identify subtle patterns indicative of advanced persistent threats or insider attacks.
NetFlow analysis provides network visibility that is essential for both security operations and network management but impossible to achieve through other monitoring approaches at enterprise scale. Full packet capture generates storage requirements that are prohibitive for most organizations and raises significant privacy concerns when capturing internal network traffic. Simple connectivity monitoring through ICMP ping or port scanning provides limited insight into actual traffic patterns and volumes.
The security value of NetFlow data becomes apparent during incident response investigations. When security teams discover a compromised system, flow data allows them to reconstruct the timeline of malicious activity, identify other affected systems, and determine what data may have been exfiltrated. This forensic capability often provides the only available evidence of lateral movement within the network, since attackers frequently use legitimate administrative protocols and tools that do not trigger signature-based detection systems.
NetFlow excels at detecting several categories of malicious activity that are difficult to identify through other means. Beaconing behavior, where malware establishes periodic connections to command-and-control infrastructure, creates distinctive patterns in flow timing and volume that are visible even when the communication is encrypted. Data exfiltration attempts create unusual outbound traffic volumes to external destinations that stand out against baseline patterns. Lateral movement generates internal traffic flows between systems that normally do not communicate directly.
The operational benefits extend beyond security to network capacity planning and performance optimization. Flow data reveals which applications consume the most bandwidth, which network paths carry the heaviest loads, and which users generate the most traffic. This information drives infrastructure investment decisions and enables organizations to optimize network performance through traffic engineering and Quality of Service (QoS) configuration.
However, NetFlow analysis faces significant limitations that organizations must understand to use it effectively. Encrypted traffic, which now represents the majority of internet communication, prevents examination of payload content and reduces the effectiveness of application classification techniques. NetFlow provides metadata about encrypted sessions but cannot reveal what data is being transmitted or received.
The sampling techniques used by many network devices to reduce processing overhead can miss short-lived flows or low-volume attacks. Many routers implement 1-in-100 or 1-in-1000 packet sampling to manage the computational load of flow processing, which means that brief reconnaissance scans or low-rate data theft may not appear in flow records.
Organizations that implement NetFlow monitoring without understanding these limitations often develop false confidence in their network visibility. Effective NetFlow programs must combine flow analysis with other monitoring techniques, including DNS monitoring, endpoint detection, and log analysis, to provide comprehensive network security coverage.
Within CDA's Threat Intelligence and Defense (TID) domain, NetFlow analysis serves as a foundational element of the Predictive Defense Intelligence (PDI) methodology. PDI's core principle of "see the threat before it sees you" requires understanding normal network behavior patterns so thoroughly that deviations indicating threat activity become immediately apparent. NetFlow data provides the quantitative foundation for this understanding.
CDA approaches NetFlow analysis differently from conventional security operations in several critical ways. Rather than using flow data primarily for incident response and forensics, CDA operators establish comprehensive behavioral baselines that enable predictive threat detection. This means implementing flow collection at sufficient granularity and retention periods to identify subtle changes in network patterns that precede active attack phases.
During C-RECON missions, CDA teams deploy NetFlow analysis to map network architectures, identify critical communication paths, and establish the normal operational patterns that must be protected. This reconnaissance is not passive observation but active intelligence collection that builds the foundation for subsequent defensive operations. Flow data reveals the actual network topology and traffic patterns rather than the theoretical architecture documented in network diagrams.
C-HARDEN campaigns incorporate NetFlow-based detection rules as core defensive measures. CDA threat detection engineering differs from conventional approaches by focusing on behavioral indicators that persist across different attack tools and techniques. While signature-based systems look for known bad patterns, CDA's NetFlow rules identify deviations from established good patterns. This approach provides resilience against novel attack methods and zero-day exploits that evade signature detection.
The PDI methodology emphasizes automation and integration of NetFlow analysis with other intelligence sources. CDA operators do not manually review flow reports but instead build automated correlation systems that combine flow anomalies with endpoint telemetry, DNS patterns, and external threat intelligence. This integrated approach enables the rapid threat detection and response that PDI requires.
CDA's NetFlow implementations typically involve more comprehensive data collection and longer retention periods than conventional deployments. While many organizations collect flow data from perimeter devices only, CDA advocates for internal flow monitoring that reveals lateral movement and insider threats. The retention periods extend far enough to identify long-term campaign patterns and seasonal variations that affect baseline accuracy.