IPFIX - IP Flow Information Export ==================================== .. panels:: :container: container pb-4 :column: col-lg-12 p-2 :card: shadow .. panels:: :container: container pb-4 :column: col-lg-12 p-2 :card: shadow **What is IPFIX?** IPFIX (IP Flow Information Export) is a protocol for exporting flow information from routers, switches, and other network devices to a collector for analysis, monitoring, and billing. It is standardized by the IETF as an evolution of Cisco’s NetFlow v9. .. panels:: :container: container pb-4 :column: col-lg-12 p-2 :card: shadow **Why is IPFIX useful?** IPFIX is useful for network monitoring, traffic analysis, intrusion detection, usage-based billing, and capacity planning. It provides detailed information about traffic flows in a standardized format. .. panels:: :container: container pb-4 :column: col-lg-12 p-2 :card: shadow **How it works?** IPFIX-enabled devices generate flow records based on observed network traffic. These records are exported to a collector using a predefined or custom template. The collector then processes and analyzes the flow data for visibility or action. .. panels:: :container: container pb-4 :column: col-lg-12 p-2 :card: shadow **Where is IPFIX used?** IPFIX is widely used by ISPs, data centers, and enterprises in network operations centers (NOCs) for monitoring, analytics, performance management, and security. .. panels:: :container: container pb-4 :column: col-lg-12 p-2 :card: shadow **Which OSI layer does this protocol belong to?** IPFIX operates at the Application Layer (Layer 7), as it defines how flow data is exported and formatted for external use. .. panels:: :container: container pb-4 :column: col-lg-12 p-2 :card: shadow **Is IPFIX Windows specific?** No, IPFIX is not Windows specific. While collectors or exporters may run on Windows, the protocol itself is platform-independent and used on a wide range of network devices. .. panels:: :container: container pb-4 :column: col-lg-12 p-2 :card: shadow **Is IPFIX Linux specific?** No, IPFIX is not Linux specific. Many open-source and commercial IPFIX collectors run on Linux, but the protocol is also supported across other platforms and network hardware. .. panels:: :container: container pb-4 :column: col-lg-12 p-2 :card: shadow **Which Transport Protocol is used by IPFIX?** IPFIX can use **UDP**, **TCP**, or **SCTP** as its transport protocol. UDP is the most common due to its lower overhead, but TCP/SCTP may be used where reliability is needed. .. panels:: :container: container pb-4 :column: col-lg-12 p-2 :card: shadow **Which Port is used by IPFIX?** IPFIX commonly uses **UDP port 4739**, though other ports can be configured depending on the implementation. .. panels:: :container: container pb-4 :column: col-lg-12 p-2 :card: shadow **Is IPFIX using client-server model?** Yes, IPFIX follows a client-server-like model where the **exporter (client)** sends flow data to the **collector (server)** for storage and analysis. .. panels:: :container: container pb-4 :column: col-lg-12 p-2 :card: shadow Topics in this section, * :ref:`Learnings in this section ` * :ref:`Terminology ` * :ref:`Version Info ` * :ref:`IPFIX Version&IEEE Details ` * :ref:`IPFIX Basic Setup on Ubuntu using IPv4 ` * :ref:`IPFIX Basic Setup on Ubuntu using IPv6 ` * :ref:`IPFIX Protocol Packet Details ` * :ref:`IPFIX Usecases ` * :ref:`IPFIX Basic Features ` * :ref:`Reference links ` .. _IPFIX_step1: .. tab-set:: .. tab-item:: Learnings in this section * In this section, you are going to learn .. _IPFIX_step2: .. tab-set:: .. tab-item:: Terminology * Terminology .. _IPFIX_step3: .. tab-set:: .. tab-item:: Version Info * Version Info .. _IPFIX_step5: .. tab-set:: .. tab-item:: IPFIX Version&RFC Details * rfc details .. _IPFIX_step18: .. tab-set:: .. tab-item:: IPFIX Basic Setup on Ubuntu using IPv4 * setup .. _IPFIX_step19: .. tab-set:: .. tab-item:: IPFIX Basic Setup on Ubuntu using IPv6 * setup .. _IPFIX_step6: .. tab-set:: .. tab-item:: IPFIX Protocol Packet Details * packet details .. _IPFIX_step7: .. tab-set:: .. tab-item:: IPFIX Usecases * usecases .. _IPFIX_step8: .. tab-set:: .. tab-item:: IPFIX Basic Features * features .. _IPFIX_step17: .. tab-set:: .. tab-item:: Reference links * Reference links