NetFlow Data and Traffic Flow Analysis

Vocabulary flashcards covering NetFlow, flow analysis, and related tools such as IPFIX, Zeek, MRTG, and SNMP, based on lecture notes.

Full Packet Capture (FPC)

Captures the entire packet, including header and payload, for all traffic; requires large storage.

NetFlow

Cisco-developed protocol for exporting traffic flow metadata to a collector; used for flow analysis; precursor to IPFIX.

Flow collector

System that records NetFlow/IPFIX metadata about traffic flows.

Flow analysis

Analysis of traffic using flow metadata to identify trends, patterns, and anomalies without capturing full payloads.

IPFIX

IP Flow Information Export; the standardization of NetFlow-like data export.

Metadata vs payload

NetFlow captures metadata (IPs, ports, protocol, etc.) about traffic rather than the actual packet contents.

Data flow (NetFlow definition)

A sequence of packets that share the same characteristics (e.g., source/destination IP and ports) treated as a single flow.

Source IP

The origin IP address in a traffic flow.

Destination IP

The target IP address in a traffic flow.

Source port

The port number on the source side used in a flow.

Destination port

The port number on the destination side used in a flow.

Zeek

Hybrid network monitor that passively analyzes traffic; logs full packets only when data is deemed interesting; normalizes data to JSON/TSV.

Normalization

Converting varied logs into a consistent format (e.g., JSON or TSV) for easier analysis.

MRTG (Multi Router Traffic Grapher)

Tool that graphs traffic on network interfaces by querying devices via SNMP.

SNMP

Simple Network Management Protocol; used to monitor and manage network devices and collect traffic data.

Data exfiltration

Unapproved or clandestine transfer of data from a network to external destinations, often detected via unusual outbound traffic.

Baseline

An expected level of normal traffic against which anomalies are detected.

Anomaly detection

Identifying traffic patterns that deviate from the baseline to find potential issues or attacks.