Specifications

Understanding Flows
May 18, 2011 Page 5 of 21
Figure 2providesagraphicdepictionofhowthesetimersinteract.Flows1and3showasingle
longlastinglogicalflow.Flow1timesoutandexpiresat30minutes,theactivetimerlength.
Becausetheflowexpires,anexportpacketissenttotheNetFlowcollector.Flow3continuesthis

longlastingflowforanother10minutes.Attime40minutestheflowends.The40secondinactive
timerinitiatesandexpiresat40minutesand40secondsresultinginanexportpackettothe
NetFlowcollectorforflow3.AttheNetFlowcollector,themanagementapplicationjoinsthetwo
flowsintoasinglelogicalflowforpurposesofanalysisandreporting.
Flow2isa7.5‐minuteflowthatneverexpirestheactivetimer.Itbeginsat2.5minutesandendsat
10minutes.At10minutestheinactivetimercommencesandexpires theflowat10minutesand40

seconds.Atthistime,NetFlowsendsanexportpacketfortheflowtotheNetFlowcollectorfor
processing.
Figure 2 Flow Expiration Timers
Deriving Information from Collected Flows
Oneachcollectionserver,aNetFlowcollectorapplicationcorrelatesthereceivedrecordsand
preparesthemforusebytheNetFlowmanagementapplication.(Insomecasesthecollectorand
managementapplicationsarebundledinasingleapplication.)Themanagementapplication
retrievestheflow records,combinesflowsthatwerebrokenupdueto
expirationrules,and
aggregatesflowsbaseduponcommonvalues,beforeprocessingthedataintousefulreports
viewablebythenetworkadministrator.
Correlatedreportscanbethebasisforsuchinformationcategoriesas:
• Understandingwhoisoriginatingandreceivingthetraffic
•Characterizingtheapplicationsthatareutilizingthetraffic
Flow Expiration
Flows
Time
Flow 1
Flow 2
Flow 2 expires
Flow has expired and export packet sent
Flow has stopped, start of inactivity timer
2.5
Min.
10
Min.
30
Min.
40
Min.
10 Min.
40 Sec.
40 Min.
40 Sec.
Flow 1 expires
Flow 3
Flow 3 expires