Question

A security engineer wants to enable traditional (non-Flexible) NetFlow v5 on a Cisco IOS router to build a baseline of traffic behavior for anomaly detection. During a design review, a colleague asks how the router decides that two packets belong to the same flow. Which set of attributes does traditional NetFlow use to define a unique flow?

Accepted Answer

Source IP address, destination IP address, source port, destination port, Layer 3 protocol, ToS byte, and input interface

Answer

Source and destination MAC addresses plus the ingress VLAN ID only

Answer

The TCP sequence number and acknowledgment number of each packet

Answer

Only the source and destination IP addresses, ignoring transport-layer information