Hack the Route Start free Open app Monitoring
NetFlow
Flow records a router exports to a collector: who talked to whom, on which ports, how much and when.
The router keeps a flow cache keyed by the 5-tuple (addresses, ports, protocol) and counts packets and bytes. A record is exported when the flow ends (FIN, reset, or the inactive timeout) or has lasted the active timeout, so a long transfer shows up late. v5 records are one-way and fixed; v9 and IPFIX use templates. No content is kept, so records are small enough to keep for months. Sampling one packet in N saves work and loses small flows.