This is a continuation of Flow Directionality Support : Part 1 which should be read first. My guess is that a flow collector vendor claiming to determine flow or NetFlow direction makes an educated guess from NetFlow v5 traffic on who initiated the connection using flow start times (using a single exporter so timestamps are …
Determining NetFlow Direction is the process of trying to ascertain who initiated a flow. Although “NetFlow Direction” is the title of this post, the word ‘Direction’ in NetFlow means something entirely different. According to the IETF standard for flow technologies called IPFIX, direction has to do with the observation point of a flow. (i.e. ingress …
NetFlow Direction and it’s Value to Troubleshooting Read More »