NetFlow has components working together.
Exporter. The router or switch that monitors traffic. It builds flow records and sends them to a collector.
Collector. A server that receives and stores flow records from multiple exporters.
Analyzer. Software that processes collected flows and produces reports. Shows top talkers and traffic trends.
Versions:
- NetFlow v5 is the classic format. Fixed -tuple flows.
- NetFlow v9 is template-based with flexible fields.
- IPFIX is the IETF standard based on v9.
Many products combine collector and analyzer into one application.