What Is NetFlow and How Does It Work? Why Understanding Network Traffic Matters?
Monday morning, 09:00. "Internet is slow" tickets are rolling in. Link utilization is 60%, all devices are green, and CPUs are calm. Everything looks "normal," yet nothing is normal. What is NetFlow, and how does it work? How does it make a difference in traffic analysis?
NetFlow is a protocol where devices like routers, switches, and firewalls summarize the traffic passing through them as flow records and send them to a collector. Each record carries information on who, to whom, via which port and protocol, how much data, and when; it does not carry the packet payload.
This allows you to measure who is consuming bandwidth, which application is creating load, when traffic deviates from the baseline, and whether QoS policies are functioning properly. SolarWinds NetFlow Traffic Analyzer (NTA) collects this data on the same platform as Network Performance Monitor (NPM).
What is NetFlow and How Does It Work? What Data Does It Collect?
NetFlow is a protocol originally developed by Cisco, and today it is commonly used as a general term for collecting metadata about IP traffic. The device groups passing packets into flows and generates a single summary record for each flow. Records are pushed to the collector—meaning, unlike SNMP where devices are continuously polled, the device proactively reports what it sees.
Three Key Components Along the Path
- Exporter: The router, switch, or firewall generating the flows.
- Collector: The server that receives and stores the records (via UDP).
- Analyzer: The layer that translates records into views like top talkers, applications, conversations, and trends. SolarWinds NTA fulfills this role alongside the collector.
How Does NetFlow Work?
-
1. Packet Arrives
Every packet passing through an interface with flow export enabled is evaluated in the device's flow cache.
-
2. Mapped to a Flow
Packets sharing key fields such as source/destination IP, source/destination port, and protocol are aggregated into a single flow, incrementing byte and packet counters.
-
3. Flow Terminates
The record is closed when the flow ends (e.g., TCP FIN/RST), remains idle for a set period, or exceeds a maximum duration.
-
4. Exported
Closed records are sent via UDP inside NetFlow or IPFIX packets to the collector.
-
5. Analyzed
The collector stores the records; the analysis layer translates them into top talker, application, conversation, and trend views.
What Data Does It Collect?
A single flow record roughly looks like this (values are examples):
source 10.20.4.15:51822 → destination 203.0.113.40:443 TCP (6)
volume 1.84 GB / 1.3 M packets
time 23:55:12 – 00:55:12
interface in: Gi0/1 out: Gi0/0 DSCP: 0| Field Group | Sample Fields | Question Answered |
|---|---|---|
| Identity | Source/destination IP, source/destination port, protocol, ToS/DSCP | Who, to whom, using which service? |
| Volume | Byte and packet count | How much data? |
| Time | Timestamp of the first and last packet of the flow | When did it start, how long did it last? |
| Location | Ingress and egress interface, next-hop | Which path did the traffic traverse? |
| Additional Context | TCP flags, BGP AS numbers, VLAN/MPLS, application ID | Which application, which user, which route? |
Flow Protocol Family
- NetFlow v5 / v9: Cisco-origin, v9 template-based, also covers IPv6.
- IPFIX: The IETF standard of NetFlow v9; the common language of multi-vendor networks.
- J-Flow, NetStream: Juniper and Huawei equivalents.
- sFlow: An alternative that works by sampling packets rather than maintaining a cache, widely used especially in switches.
What Does NetFlow Enable You to Measure?
SNMP tells you "what percentage of the link is utilized." NetFlow breaks that same link down into its components. Main things it measures:
Is It Possible to Monitor Network Performance with NetFlow?
Partially yes; and it is important to know its limitations. NetFlow measures the traffic side that affects performance very well: link utilization, congestion points, which application and host are creating load, and volume by QoS class. However, standard flow records do not carry quality metrics such as latency, jitter, or packet loss.
| Performance Question | NetFlow Alone | What Complements It? |
|---|---|---|
| Why is the link full, where is the congestion? | Yes: top talkers, application, and conversation breakdown | Verified with SNMP counters |
| Which application is degrading performance? | Yes: application and protocol distribution | Application recognition like NBAR2 |
| Is the QoS policy working? | Yes: volume by DSCP/class | CBQoS drop data (SNMP) |
| Latency, jitter, packet loss | Generally no | Active measurement or packet analysis |
| Device health | No | SNMP |
The practical answer is: NetFlow does not replace performance monitoring; it provides traffic context to it. In SolarWinds NTA, this context can be viewed alongside other metrics in the exact same time window via PerfStack.
What is a Network Performance Monitoring (NPM) Solution?
Which Problems Does It Enable You to Detect Quickly?
-
Hidden Congestion
Shows short-term spikes hidden by minute-level SNMP averages, along with which host and application created that load.
-
Unknown Cause
Capacity upgrades should not rely on guesswork. If two backup jobs are filling the link, the solution is not to expand the link, but to change the schedule.
-
Shadow IT
Cloud storage, P2P, or applications violating corporate policy might be occupying the link without anyone knowing. Application breakdown detects this.
-
Security Signal
Anomalies such as unexpected external connections or scanning numerous ports from a single source can be read in flow records.
Which Popular Network Devices Support NetFlow?
Most enterprise-class routers, switches, and firewalls can export flows. The list is not exhaustive; support is determined by model, software version, and license.
| Vendor | Sample Platforms | Flow Type |
|---|---|---|
| Cisco | Catalyst 9000, ASR, ISR, Nexus, Meraki MX | Flexible NetFlow (v9/IPFIX); sFlow on some Nexus models |
| Juniper | MX, vMX, T series, EX, SRX, NFX | J-Flow / inline flow monitoring (IPFIX, v9) |
| Palo Alto | PAN-OS firewalls | NetFlow; can also export App-ID and User-ID fields |
| Fortinet | FortiGate, FortiSwitch | NetFlow, IPFIX, and sFlow (depending on model) |
| Virtual Environment | VMware vSphere Dist. Switch, Open vSwitch | IPFIX, NetFlow v9 |
Which Software is Recommended for Analyzing NetFlow Data?
The right software depends on the size of your network, your cloud/on-prem preference, and your team's existing toolset.
| Solution | Deployment | Strongest Area |
|---|---|---|
| SolarWinds NTA | Self-hosted (NPM Plugin) | Flow + device health + configuration on the same platform; NBAR2, CBQoS |
| NetFlow Analyzer | Standalone product | Interface-based licensing, forecast, and billing reports |
| Paessler PRTG | General-purpose monitoring | Wide sensor range in a single tool, easy start |
| Kentik | Cloud (SaaS) | Service provider, BGP, and DDoS analytics |
How Does SolarWinds NTA Differ from Its Competitors?
SolarWinds NTA is a product running on the SolarWinds Platform that collects flow data and turns it into bandwidth analysis. It is not a standalone product; it is an NPM plugin. It differentiates itself from competitors with the following points:
-
Single Platform
Flow data sits alongside device and interface views. You can transition from a "link full" alarm to CPU correlation via PerfStack in the exact same console.
-
Application Awareness
With NBAR2-based application recognition, you read traffic in the language of "departments" or "applications." You can receive alarms when application traffic drops.
-
QoS Validation
CBQoS pre/post-policy and drop alarms show whether the policy is actually producing the desired result.
-
Secure Data
Because it runs self-hosted, flow data is processed within your own infrastructure; helping with security and compliance requirements.
Frequently Asked Questions
Q: What is NetFlow?
NetFlow is a protocol developed by Cisco that allows network devices to summarize passing IP traffic as flow records and send them to a collector. Records carry source/destination IP, port, protocol, data volume, and timestamp information; they do not carry the packet payload.
Q: What is the difference between NetFlow and SNMP?
SNMP shows device health and aggregate counters. NetFlow, on the other hand, shows the content of the traffic—meaning who talked to whom, with which application, and how much. Most organizations use both together.
Q: Does SolarWinds NTA work without NPM?
No. According to SolarWinds documentation, NetFlow Traffic Analyzer is not a standalone product; it runs on the same SolarWinds Platform server as a Network Performance Monitor (NPM) plugin.
Q: Does NetFlow see the packet payload?
No. It only carries header metadata. Separate methods such as packet capture or deep packet inspection are required for message content.
Conclusion: Reading Traffic Instead of Guessing
NetFlow transforms the "link is full" information into "who, with what, and since when" information. The right tool depends on your network size, cloud/on-prem preference, and your team's existing toolset. Where SolarWinds NTA is strongest is in architectures where flow data runs on the same platform as device health and configuration.
If you want to see NTA on your own network, you can plan a 30-day trial with our experts.
Contact Us →