Cisco flow logs and intrusion detection at the Ohio State University
Steve Roming · ;login:: the magazine of USENIX & SAGE · 1999
Many Cisco router support NetFlow accounting, which provides fast accesss-control list proccessing, accounting and switching/routing with minimal impact on performance. One of the side benefits of enabling routing is that you can then capture a record on the flows as they are removed from the cache, creating we call a flow log. Among other things, the logs contain the source and destination IP addresses for all IP packets, source and destination port numbers for UDP and TCP traffic, and packet and octet counts.