After I had posted my article on configuring NetFlow export on Cisco devices, various people emailed me asking what, exactly, NetFlow is. It just so happens that Dark Reading has recently published an article on the topic. To explain what NetFlow is:

It is simply the aggregation of packets into “flows” and the reporting of that data. A flow is a collection of packets that can be characterized by source and destination IP addresses and ports, as well as a few more characteristics. The packets in a particular flow are counted and reported to a collector. Cisco and most other routers support NetFlow. NetFlow is used by all the major ISPs and carriers to resolve peering issues and account for whose traffic flows over which network.

Imagine being able to classify all of the traffic on your network into source, destination, and application. You can immediately determine which applications, users, and servers consume the most resources. You may be surprised, as the operators of Internet2 were, to discover that over 90% of your traffic is not business related, for instance. You may find a server that has been infected with a worm for months, spewing packets that eat up valuable bandwidth. You may discover unauthorized Web, gaming, IRC, or Warez servers on your network.

Read the full article here: http://www.darkreading.com/document.asp?doc_id=101496