Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Cisco Netflow - differences between packets and flows


I'm new to the Cisco Netflow technology. I was wondering if anyone would be able to help clarify for me the differences between the term "packets" and "flows"?

My understanding of the term packet and flow is as follows:


- data unit transmitted from origin to destination via internet.

- in terms of Netflow, payload of the packet is a set of flow records i.e. one packet might contain 5 flow records.

- contains the source and target IP to tell where the packets is going to.

2) flow

- data records consisting a number of fields i.e.

a)flow type

b)flow source/destination IP

c)flow source/destination port

d)flow input/output index

e)flow source/destination prefix

(list continues...)

- is the "payload" of the packet containing network statistics.

Could anyone help me out by verifying my undestanding on the differences between packets and flows, as I don't really have a clear-cut understanding as where exactly the flow is located within the IP packets travelling between the routers.



  • Network Management
Hall of Fame Super Silver

Re: Cisco Netflow - differences between packets and flows


It seems to me that you are making it a bit more complex than it needs to be. I offer this explanation:

A packet is the unit of data transmitted through the network from a source station to a destination station. The packet has a source address and a destination address indicating where it came from and where it is going to. The packet also has fields (frequently port numbers) that indicate what kind of data is in the payload of the packet. The packet might carry data for telnet, or for FTP, or for NetFlow.

A flow is a series of packets. The series is defined by having the same source address, same destination address, and same port numbers.

That defines a packet and a flow. What you seem to be interested in is the feature that Cisco introduced of NetFlow. NetFlow analyzes packets as the router forwards them and accumulates statictics on the flows which can be examined and reported. The list of data elements that you list for flow is the list of data elements that NetFlow can report on the flows that it has analyzed.



This widget could not be displayed.