NetFlow vs. IPFIX
First of all, IPFIX is an enhanced version of NetFlow v9, widely considered as NetFlow v10. IPFIX is an IETF standard specifically designed to make it easier to open up flow to a broad range of vendors.
As you may already know, IPFIX RFC 5101 and RFC 5102 are derived from the NetFlow v9 RFC. IPFIX is also backward compatible with v9, which was fuelled by vendors' desire to move away from Cisco-driven standards. This essentially allows hardware vendors to specify a vendor ID, to put any proprietary information into a flow, and to export it out of the collector/analyser for further dissecting and monitoring. NetFlow v9 now supports Flexible NetFlow, which is almost equal to IPFIX. By default, IPFIX listens on UDP port 4739 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access