NetFlow collects IP traffic information as records and sends them to a NetFlow collector for traffic flow analysis.

Let’s take an example! In the topology below, when traffic from Network 1, 2, 3… passes through the interfaces of a NetFlow enabled device, relevant information is captured and stored in the NetFlow cache. NetFlow helps network administrators answers the questions of who (users), what (application), when (time of day), where (source and destination IP addresses) and how network traffic is flowing. NetFlow is a networking analysis protocol that gives the ability to collect detailed information about network traffic as it flows through a router interface. Luckily we have another amazing tool: NetFlow! One of the most important tasks of a network administrator is to monitor the health of our networks, learn how our bandwidth is being used, what applications are consuming it, when it needs upgrade… Although monitoring protocols like SNMP and SPAN (port mirroring) can help us answer some questions but they are not enough to give us an insightful view of our networks. In order to do so, LISP provides the distributed architecture EID-to-RLOC mapping that maps EIDs to RLOCs. Only the RLOC (which represents the IP address of the connected router) changes. In other words, when the device moves from one location to another, it still keeps its IPv4 or IPv6 address, which is the EID part. With LISP, the change in location of a device does not result in a change in its identity. + Routing locators (RLOCs) – assigned to devices (primarily routers) that make up the global routing system. + Endpoint identifiers (EIDs) – assigned to end hosts. Locator ID Separation Protocol (LISP) solves this issue by separating the location and identity of a device through the Routing locator (RLOC) and Endpoint identifier (EID): We can say routing in the Internet today is like putting direction signs about every city in the world at every crossing. When a host moves from one location to another location, it is assigned a different IPv4 or IPv6 address, which overloads the location/identity semantic. In the Internet nowadays, the IPv4 or IPv6 address of a device represents both its identity and location.

Free netflow traffic analyzer