NetFlow and sFlow Configuration Guide on Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

NetFlow and sFlow Configuration Guide on Cisco 8000 Series Routers, Cisco IOS XR Releases

NetFlow components

Updated: June 9, 2026

Want to summarize with AI?

Log in

Explains the main components and terms used in NetFlow for network traffic analysis.

A NetFlow component is a network feature that

  • collects, processes, and exports flow data from network devices

  • enables monitoring and analysis of IP or MPLS packet flows, and

  • facilitates storage and examination of flow records for network insight

  • Data source: Specific locations within the router, such as physical interfaces and VLANs, where traffic measurements can be taken.

  • Flow: A collection of IP or MPLS packets traversing the router during a time period. All packets belonging to a particular flow share common attributes derived from the packet's data.

  • Flow record: A set of key and non-key NetFlow field values used to characterize flows in the NetFlow cache. It is generated by examining packet headers and adding a description of packet details in the NetFlow cache.

  • Exporter: A component within the router that has NetFlow enabled. An exporter monitors incoming packets, generates flows from them, and transmits information derived from these flows, encapsulated as flow records, to the NetFlow collector.

  • Collector: An external device designed to receive flow records from one or multiple exporters. The collector processes the incoming export packets and stores the associated flow record details. Optionally, flow records can undergo aggregation before being stored on the hard disk.

  • NetFlow cache: A segment of memory that stores flow entries prior to their exportation to an external collector. This includes two cache types: the normal cache and the permanent cache.

  • NetFlow analyser: An external device or application responsible for collecting and scrutinizing flow records to provide valuable insights.

  • Collector address: The IP address and UDP port number used by the collector. By default, the designated destination port number is 2055.

NetFlow component attributes and terms

Describes the main attributes and terms associated with NetFlow components for network traffic analysis.

  • Data source: Specific locations within the router, such as physical interfaces and VLANs, where traffic measurements can be taken.

  • Flow: A collection of IP or MPLS packets traversing the router during a time period. All packets belonging to a particular flow share common attributes derived from the packet's data.

  • Flow record: A set of key and non-key NetFlow field values used to characterize flows in the NetFlow cache. It is generated by examining packet headers and adding a description of packet details in the NetFlow cache.

  • Exporter: A component within the router that has NetFlow enabled. An exporter monitors incoming packets, generates flows from them, and transmits information derived from these flows, encapsulated as flow records, to the NetFlow collector.

  • Collector: An external device designed to receive flow records from one or multiple exporters. The collector processes the incoming export packets and stores the associated flow record details. Optionally, flow records can undergo aggregation before being stored on the hard disk.

  • NetFlow cache: A segment of memory that stores flow entries prior to their exportation to an external collector. This includes two cache types: the normal cache and the permanent cache.

  • NetFlow analyser: An external device or application responsible for collecting and scrutinizing flow records to provide valuable insights.

  • Collector address: The IP address and UDP port number used by the collector. By default, the designated destination port number is 2055.