What data does NetFlow collect and how is it used in traffic analysis and capacity planning?

What data does NetFlow collect and how is it used in traffic analysis and capacity planning?

• A. It collects per-packet payloads and is used for deep content inspection.
• B. It collects flow-level data such as source, destination, ports, and bytes; used to analyze traffic patterns and plan capacity and QoS.
• C. It records only the total bytes transferred per minute.
• D. It stores device firmware versions for inventory.

Answer: (B)

NetFlow collects flow-level data to map traffic patterns and capacity needs. It records per-flow summaries rather than packet payloads. For each flow, NetFlow captures where traffic comes from and goes to (source and destination IPs), the ports involved, the protocol, and metrics like the number of bytes and packets and the start and end times. This allows you to see who is talking to whom, which applications are using bandwidth, and how traffic changes over time. With that information, you can build utilization reports, identify bottlenecks, perform capacity planning, and design QoS policies to prioritize critical traffic. It is not designed to capture content within packets, so it cannot perform deep content inspection. It also provides more granularity than a single minute-level total, since you can analyze and aggregate flows over various time windows as needed. It does not store inventory data such as firmware versions.

NetFlow collects flow-level data to map traffic patterns and capacity needs. It records per-flow summaries rather than packet payloads. For each flow, NetFlow captures where traffic comes from and goes to (source and destination IPs), the ports involved, the protocol, and metrics like the number of bytes and packets and the start and end times. This allows you to see who is talking to whom, which applications are using bandwidth, and how traffic changes over time. With that information, you can build utilization reports, identify bottlenecks, perform capacity planning, and design QoS policies to prioritize critical traffic. It is not designed to capture content within packets, so it cannot perform deep content inspection. It also provides more granularity than a single minute-level total, since you can analyze and aggregate flows over various time windows as needed. It does not store inventory data such as firmware versions.