tcblogposts
0
min read

May 22, 2024

Want to learn more about NetFlow? Here's a useful analogy to get you started

Infographic explaining NetFlow using a train analogy, with a train passing a router station, introducing NetFlow as a tool for monitoring malicious activity and improving internet security
NetFlow train analogy: internet data packets are like boxcars on trains traveling between cities, and routers are the depots that direct them along the tracks to their destination
NetFlow sampling explained: like depot workers counting one boxcar per train, routers sample about 1 in 3,000 to 1 in 10,000 packets and record source IP, destination IP, ports, and packet counts, but not content
How NetFlow data supports threat intelligence: spotting boxcars of a certain size and color reveals the source and destination of illicit shipments, much like tracking traffic to command and control (C2) servers
NetFlow conveys no content: it confirms communication between two endpoints, helping defenders reveal malicious infrastructure behind DDoS, ransomware, and credential theft

‍

The NetFlow Advantage
See the traffic behind the threat.

Research like this starts with global visibility into internet traffic beyond your own edge: who talked to whom, when, and from where.

See the NetFlow Use Cases →
Pure Signal™ Command
Take the next hunt into Command.

Search, pivot, and act on internet infrastructure in one AI-assisted environment, built on visibility into 400B+ daily connections.

Get an Analyst-Led Walkthrough →