210-255 · Question #79
Which of the following are not components of the 5-tuple of a flow in NetFlow? (Select all that apply.)
The correct answer is B. Flow record ID C. Gateway. The standard NetFlow 5-tuple identifies a flow using source IP, destination IP, source port, destination port, and IP protocol - flow record IDs and gateways are not part of this tuple.
Question
Which of the following are not components of the 5-tuple of a flow in NetFlow? (Select all that apply.)
Options
- ASource IP address
- BFlow record ID
- CGateway
- DSource port
- EDestination port
How the community answered
(58 responses)- A2% (1)
- B91% (53)
- D5% (3)
- E2% (1)
Why each option
The standard NetFlow 5-tuple identifies a flow using source IP, destination IP, source port, destination port, and IP protocol - flow record IDs and gateways are not part of this tuple.
Source IP address is one of the five standard 5-tuple fields and is required to identify the origin host of a flow.
Flow record ID is an internal bookkeeping identifier used by some NetFlow collector implementations but is not one of the five fields that define a unique flow in the standard 5-tuple specification.
Gateway refers to a next-hop routing device and is a network topology concept, not one of the five packet-header fields used to classify and track network flows in NetFlow.
Source port is a core 5-tuple field that, combined with destination port and IP protocol, uniquely identifies transport-layer sessions within NetFlow.
Destination port is a core 5-tuple field that enables differentiation of flows directed toward different services or applications on the same destination host.
Concept tested: NetFlow 5-tuple flow identification fields
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/get-start-cfg-nflow.html
Topics
Community Discussion
No community discussion yet for this question.