Which data format is the most efficient to build a baseline of traffic seen over an extended period of time?

Question

Options

• Asyslog messages
• Bfull packet capture
• CNetFlow
• Dfirewall event logs

• B
  2% (1)
• C
  93% (41)
• D
  5% (2)

Explanation

NetFlow is the most efficient format for building a traffic baseline over extended periods because it captures metadata about network flows (source/destination IPs, ports, protocols, byte/packet counts, timestamps) without storing actual packet content, making it lightweight enough to retain data for weeks or months at scale. Syslog messages (A) are event-driven logs focused on system and application events rather than network traffic patterns, making them unsuitable for comprehensive traffic baselining. Full packet capture (B) records every byte of every packet, which is extremely storage-intensive - retaining it over extended periods is cost-prohibitive and impractical for most organizations. Firewall event logs (D) only record traffic that matches specific rules (allow/deny decisions) and miss the broader picture of normal traffic behavior needed for a true baseline.

Memory Tip: Think of NetFlow as a "phone bill" - it tells you who called whom, when, and for how long without recording the actual conversation. This efficiency makes it the gold standard for long-term traffic analysis and anomaly detection.

No community discussion yet for this question.