Implementation of data collection tools using NetFlow for statistical ...

2 Theoretical background
Illustration 3: NetFlow overview
It is worth mentioning that a TCP header is only 20 bytes in size [51].
See appendix 8.2 for information on how to configure NetFlow on Cisco devices.
2.5 sFlow
Much like NetFlow, sFlow collects network traffic information for use in monitoring the network. It
is an industry standard, which means it is supported on a majority of devices. It too sends network
traffic information to a collector for further analysis. This collector is a computer running any of the
many available programs for gathering flow-data. It works by sampling the network traffic – that is,
it tags packets, one out of every N packets, and send it to the collector. The marked packet's header
information is saved into a new packet and sent to the collector once it reaches 1500 bytes (the
maximum size for a packet). Along with the header information from packets, information about the
sampling rates and interface id are also included. This type of sampling is called random sampling.
The other type of sampling method involves basing the samples on a time-based polling interval
and is called counter sampling. [39] [40] [41] [42] [43][46]
2.6 IPFIX
Internet Protocol Flow Information Export (IPFIX) is a protocol created by the IETF in an attempt
to create a common universal standard for flow information from routers and other devices,
eliminating the need for a specific vendor to create a version of its own [44]. Being based on Cisco's
NetFlow version 9, the characteristics for defining a flow are the same - same source, same
19