IP flow is an unidirectional stream of IP packets of a certain network protocol, traveling between two network points. IP flow provides information about the source and destination IP address, source and destination port, protocol, DSCP field, etc. within a certain period of time. Within an IP flow all IP packets have identical:
IP flow accounting is a feature of a router enabling it to create IP flows collection, count IP flows passing through it and to export the traffic via NetFlow® protocol. The collection itself consists of the following data:
NetFlow is a network protocol, developed by Cisco Systems, used for exporting collected IP flow traffic. This data is exported to a server, where it is collected, processed, aggregated and archived. It can then be reviewed in a more user-friendly form. NetFlow Analyzer performs all of these functions. There are numerous NetFlow protocol versions, most important of which are versions 5 and 9. Version 5 is commonly used on most Cisco NetFlow enabled devices. NetFlow version 9 is the latest version, created to support advanced technologies such as MPLS, IPv6, Multicast, VLANs, etc.
NetFlow data overhead is expected to be less than 0.5% of the total network traffic included in the charts. This means, for instance, that 1 Mbps user traffic will produce approximately 50 kbps of additional traffic exported from routers to NetFlow Server.
To provide even more HDD saving while storing data for a longer period, our aggregation works in a way that shorter history is shown in smaller grains (more details and space consumption), whereas longer history is presented in larger grains (less details and space consumption).
For the best use of monitoring and comparison, you can see the following grains:
Grain Name | Grain Period | Grain Size |
---|---|---|
G1 | Previous 3 weeks | 1 min/5 min |
G2 | Previous 3 months | 30 min |
G3 | Maximum history | 3 hour |
Maximum history period is defined in Settings ( > Settings > NetFlow Settings > Configuration > Database size in weeks) |