A network owner needs a week-long record of which internal addresses talked to which internet addresses and roughly how many bytes moved. Storing every frame, including payloads, is more than the storage budget allows. Which monitoring data fits?
Select an answer to reveal the explanation.
Short Explanation
You asked who talked to whom and about how big the conversation was, and you refused to keep every envelope. Flow records are the index cards for those conversations. A full capture is the box of envelopes you said you cannot store, and an interface counter only tells you the port was busy.
Full Explanation
Flow records summarize a conversation: the addresses and ports involved, timing, and byte or packet counts, exported from a router or switch. A week of those summaries answers which internal addresses talked to which internet addresses and roughly how much moved, without retaining every frame. That fits both the question and the storage limit. A continuous packet capture stores the frames themselves, payloads included, which is exactly the volume the owner ruled out. Captures are the right tool when the payload or the precise headers matter, and they are the wrong default for a week of usage accounting. SNMP interface counters report aggregate octets and packets on a port. They can show that an uplink was busy, and they cannot name the two addresses in a conversation. A syslog message about an administrator login is an audit event for device management. It does not inventory user traffic to the internet. Exam caveat: sampled flow can miss short conversations. If the owner needs every brief flow, the export has to be unsampled or sampled lightly enough that the missing data is acceptable. Operational check: export flow from the internet edge for a known test download and confirm the record shows the internal address, the remote address, and a byte count in the right range, without a payload field.