NetFlow — Who Talked to Who

20 min In Progress

Learning Objectives

  • Explain what NetFlow records (and what it does NOT record)
  • Configure flow export at a conceptual level
  • Find the top talker in a list of flow records

Metadata, Not Content

NetFlow records traffic metadata: source, destination, ports, protocol, and byte counts -- not the actual packet content. It's how you spot 'this host is suddenly sending 10x its normal traffic' without ever inspecting payloads. Genuinely useful for SOC/blue-team traffic analysis too.

Real Cisco IOS syntax -- reference only.
interface GigabitEthernet0/1
 ip flow ingress
 ip flow egress

ip flow-export destination 192.168.1.100 2055
ip flow-export version 9

Practice — Find the Top Talker

A simulated batch of flow records and a quick scan for the heaviest sender.

flows = [
    {"src": "10.0.0.5", "dst": "8.8.8.8", "bytes": 4096},
    {"src": "10.0.0.7", "dst": "1.1.1.1", "bytes": 512000},
    {"src": "10.0.0.5", "dst": "8.8.4.4", "bytes": 2048},
]

top = max(flows, key=lambda f: f["bytes"])
print(f"Top talker: {top['src']} sent {top['bytes']} bytes")

📝 Exercise: Aggregate Flow Data Per Host

Write a function total_bytes_by_source(flows) that returns a dict mapping each source IP to its total bytes sent across all flow records. Then print the result sorted from highest to lowest total.

code.py
Output

            

        

    


    

        ← Back to Chapter