Build IPFIX flow telemetry you can trust before an incident

Source facts: IPFIX exports structured observations about flows

RFC 7011 specifies the IP Flow Information Export protocol. An exporting process sends data records described by templates to a collecting process. Information elements can describe addresses, ports, protocols, counters, timing, interfaces, and other observed properties. Observation domains and points provide context for where the metering occurred.

Templates are essential to decoding data records and have transport and refresh considerations. Sequence numbers can help a collector detect gaps, but they do not make delivery perfectly reliable or recover every missing record. Sampling, aggregation, cache behavior, exporter resources, clock accuracy, transport, and field support affect what the collector receives and what analysts can infer.

RFC 9232 discusses network telemetry frameworks and emphasizes connecting telemetry selection to operational objectives, data models, collection, and analysis. CISA has included flow monitoring such as IPFIX in official visibility guidance for network infrastructure. Flow telemetry is metadata, not full packet capture: it normally cannot show packet payload and may not distinguish permitted business activity from malicious activity without additional context.

DSE recommendation: engineer flow collection as an evidence pipeline

Start with the questions responders need to answer, then prove that the selected exporter and collector produce complete-enough evidence for those questions.

1. Define use cases. Prioritize questions such as unexpected external communication, lateral movement, unusual management access, data movement, denied connections, service dependency, and incident scoping. For each, identify required direction, fields, precision, history, and response time.
2. Choose observation points. Map internet edges, data-center boundaries, user networks, server segments, cloud gateways, VPN termination, management networks, and high-value zones. Record whether addresses are observed before or after translation and where asymmetric traffic or encrypted tunnels limit visibility.
3. Select fields deliberately. Document addresses, ports, protocol, start and end time, bytes, packets, interfaces, direction, TCP flags, forwarding status, application identifiers, and vendor elements actually supported. Preserve exporter, observation domain, template, site, and configuration version as provenance.
4. Manage templates and transport. Verify that collectors receive current templates after restart, failover, and path interruption. Monitor unknown templates, decoding errors, exporter resets, sequence gaps, transport failures, and stale sources. Use supported secure transport or protected management paths where available.
5. Validate time, sampling, and scale. Synchronize exporters and collectors, document clock quality, record sampling algorithms and rates, and test burst conditions. Size cache, export bandwidth, collector ingestion, storage, and queries for peak—not average—load. Treat changed sampling as a change to the evidence.
6. Test known traffic. Generate approved connections with known endpoints, ports, timing, direction, volume, allow or deny result, and address translation. Confirm that records arrive, decode correctly, retain the needed precision, appear in searches, and remain available through the promised retention period.
7. Protect and govern the data. Restrict exporter configuration and collector access, monitor pipeline changes, back up configurations, define retention, and handle flow metadata according to privacy and customer obligations. Document blind spots and teach analysts not to infer payload, user identity, or causation that records do not contain.

Factual boundary: IPFIX is an extensible export protocol, so available fields and behavior vary by exporter and collector. Missing records can reflect sampling, cache pressure, transport loss, template problems, asymmetric routing, or configuration—not necessarily an attacker. Complete flow records still do not contain packet payload.

Measure active exporters, expected observation-point coverage, template failures, sequence gaps, clock drift, sampling changes, ingest delay, dropped records, storage pressure, query latency, and successful known-traffic tests. Trustworthy flow telemetry is not achieved when a dashboard appears. It is achieved when responders know what was observed, what may be missing, and how to verify the pipeline before relying on it.

Official references

• IETF, Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information, RFC 7011.
• IETF, Network Telemetry Framework, RFC 9232.
• CISA, Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System.