Flow analysis with NetFlow and IPFIX
Without keeping full packets you see who talked to whom and how much with flow records, build baselines and catch deviations.
Level 201 · 15 lessons · 12 practice labs
Lessons
What a flow is
- What a flow record is: five-tuple, bytes, packets, duration
- NetFlow v5, v9 and IPFIX: templates and fields
- Flows or full packets: what you gain and what you lose
- Short task: turn a PCAP into flow records by hand
Collecting
- Exporting flows from an interface with softflowd
- Setting up an nfcapd collector and file rotation
- Getting flows from routers and firewalls: exporter settings
- Sampling: how 1-in-N affects your results
- Short task: collect the lab network’s flows for one hour
Analysis
- nfdump filters and top-talker lists
- Baselines: normal volume by hour, day and host
- Detecting scans and lateral movement with flows
- Catching unusual outbound data volume
- Short task: find the large transfer that starts at 03:00
- Capstone: produce an incident summary from a week of flow data
Practice labs
- Read the fields of a flow record: Explain the source, destination, port, protocol, byte, packet and duration fields in five flow records.
- Turn a PCAP into flows by hand: Group a small capture by five-tuple and write each flow's packet and byte totals into a table.
- Flow or full packet: Compare flow and full packet data of the same event and write three questions flows can answer and three they cannot.
- Export flows with softflowd: Start softflowd on the lab interface and confirm flows reach the collector.
- An nfcapd collector with file rotation: Set up an nfcapd collector with five-minute file rotation and list the files it produces.
- The effect of sampling on results: Collect the same traffic unsampled and at 1 in 100 sampling and show what disappears from the top talkers list.
- The top talkers list: List the ten top source talkers by bytes with nfdump.
- Inspect one service with an nfdump filter: Filter only outbound SSH flows and aggregate them by destination.
- Build an hour-by-hour baseline: Derive the total volume for each hour from a day of flow data and mark the hour that departs from normal.
- The big transfer that started at 03:00: In prepared flow data find the source, destination and total size of the large transfer that began at night.
- Detect scanning with flows: Find the internal host opening small flows to many targets in a short time and give the number of ports it touched.
- An incident summary from a week of data: In a week of Ayçiçeği Gıda flow data find the lateral connections and the unusual outbound volume and write a half-page summary.
About this course
Without keeping full packets you see who talked to whom and how much with flow records, build baselines and catch deviations.
What you will learn
- What a flow is
- Collecting
- Analysis
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.