Hello Carl,

your understanding is correct.

IPFIX is defined in RFC 5101 of January 2008

http://www.ietf.org/rfc/rfc5101.txt

and it is thought to be used for the same purposes as Netflow.

The network device will export flow based statistics data to a Collector.

the flow is defined based on the following:

A Flow is defined as a set of IP packets passing an Observation

Point in the network during a certain time interval. All packets

belonging to a particular Flow have a set of common properties.

Each property is defined as the result of applying a function to

the values of:

1. one or more packet header fields (e.g., destination IP

address), transport header fields (e.g., destination port

number), or application header fields (e.g., RTP header

fields [RFC3550]).

2. one or more characteristics of the packet itself (e.g.,

number of MPLS labels, etc...).

3. one or more of fields derived from packet treatment (e.g.,

next hop IP address, the output interface, etc...).

A packet is defined as belonging to a Flow if it completely

satisfies all the defined properties of the Flow.

Hope to help

Giuseppe