NetFlow and IPFIX Explained: Flow Records & Detecting Data Exfiltration (Animated)
Recording every packet is expensive. Routers and firewalls instead export flow records: a summary of each conversation with source, destination, ports, bytes and duration. Encryption hides the content, but not the shape of the traffic, which is often enough to catch an attacker.
1. A flow record: summarising a conversation
The PC browses normally. When the conversation ends (or times out), the router sends one small record describing it to the collector.
- HTTPS (Finance PC → Internet): Ordinary encrypted traffic.
- FLOW RECORD (Edge router → Flow collector / SIEM): A small download, the normal pattern for this PC.
Wireshark filter:
cflow
2. The baseline: what normal looks like
Over weeks the SIEM learns each machine’s normal: who it talks to, how much, and when. Finance PCs download far more than they upload, during office hours.
- FLOW RECORDS (Edge router → Flow collector / SIEM): Thousands of records build the baseline.
Example query:
Top talkers by bytes out, per host, last 30 days
3. Exfiltration: attack: data leaving at 3 a.m.
A compromised PC uploads gigabytes of encrypted data to a server it has never contacted before, at night, and checks in with its controller every 60 seconds (beaconing). Content inspection sees only encryption.
- HTTPS (Finance PC → Unknown server): A huge encrypted upload in the middle of the night.
- FLOW RECORD (Edge router → Flow collector / SIEM): The flow record captures the shape of the theft, even though the content is encrypted.
What stands out:
Bytes out ≫ bytes in · new destination · night time · perfectly regular intervals
4. Flow analytics: defence: alert on the shape of traffic
SIEM rules compare each flow with the baseline: unusual volume, new destinations, off-hours activity and regular beaconing raise alerts. The SOC isolates the host and blocks the destination.
- ALERT → BLOCK (Flow collector / SIEM → Edge router): The SOC acts on the alert.
- HTTPS (Finance PC → Unknown server): The rest of the upload is stopped.
Example siem rule:
bytes_out > 20× host baseline AND destination first seen < 7 days → high alert
Practise this in a real lab
Export flows from a lab router into a SIEM, build a baseline, and write alerts for large uploads and regular beaconing.
Explore ER Segment training →FAQ
What is in a flow record?
The 5-tuple (source and destination IP, ports, protocol), start and end time, packets and bytes, and often TCP flags and interface.
NetFlow, IPFIX, sFlow: what’s the difference?
NetFlow is Cisco’s format (v5/v9), IPFIX is the open standard based on v9, sFlow samples packets instead of tracking every flow.
Can flows detect encrypted attacks?
Often yes: unusual volumes, destinations, times and regular beaconing patterns stand out even without seeing content.