The SOC wants to know which internal hosts talked to which destinations, for how long and with how many bytes, across the whole campus, retained for 90 days. Storage for full packet capture is not available. Which telemetry source fits?
Select an answer to reveal the explanation.
Short Explanation
Flow records are your phone bill: who called whom, when, and for how long, but not what was said. That's exactly the who-talked-to-whom question, and it's cheap to keep for months. The trap is packet capture, which is the full recording and blows up your storage.
Full Explanation
Flow telemetry summarizes conversations rather than recording them. Routers, switches and firewalls that support NetFlow or its IETF standard counterpart IPFIX aggregate packets sharing the same key fields, such as source and destination address, ports and protocol, and export records containing timestamps and packet and byte counts to a collector. Because each record represents an entire conversation, the volume is small compared with the traffic itself, which makes campus-wide coverage and long retention practical. That answers who talked to whom, when, for how long and how much. Full packet capture records payloads and is far more storage-intensive; limiting it to a few links also leaves most campus conversations uncaptured, and the stem rules it out. SNMP interface counters report aggregate utilization per interface but carry no information about which hosts or destinations were involved. DHCP logs map addresses to devices at a point in time, which is useful context for attributing flows, but they say nothing about the conversations those devices had. Exam caveat: sampled flow export reduces load but can miss short flows, which matters for forensic completeness. Operational check: confirm flow export is enabled at the campus distribution and edge devices, that the collector receives records from each exporter, and that a known test session appears with correct byte counts.