Deriving Information from Collected Flows

On each collection server, a third-party NetFlow collector application correlates the received records and prepares them for use by the NetFlow management application. (In some cases the collector and management applications are bundled in a single application.) The management application retrieves the flow records, combines flows that were broken up due to expiration rules, and aggregates flows based upon common values, before processing the data into useful reports viewable by the network administrator.

Correlated reports can be the basis for such information categories as:

• Understanding who is originating and receiving the traffic
• Characterizing the applications that are utilizing the traffic
• Examining flows by priority
• Characterizing traffic utilization by device
• Examining the amount of traffic per port