Network monitoring tools collect NetFlow flow records—as well as records from analogous standards such as J-Flow, sFlow, IPFIX, and NetStream—from routers and switches, or from network probes deployed at key traffic points.
By analyzing the NetFlow traffic flows, these tools provide important information about traffic volume and what applications and users are conversing over the network, based on source and destination IP addresses, port numbers, and other information contained in L2-L4 packet layers. To provide application-level understanding, some network performance management (NPM) solutions supplement NetFlow analysis with offline deep packet inspection, which provides L7 forensic analysis.
Read how the ExtraHop system provides continuous, real-time information about network performance in addition to application-level protocols.