300-320 · Question #114
Which part of the Layer 3 header is used to identify a flow in NetFlow but it is not used for NBAR?
The correct answer is B. ToS. NetFlow identifies a flow using a 7-tuple key: source IP, destination IP, source port, destination port, Layer 3 protocol type, input interface, and ToS (Type of Service / DSCP byte). The ToS field is included in the NetFlow key to differentiate flows that may share the same…
Question
Which part of the Layer 3 header is used to identify a flow in NetFlow but it is not used for NBAR?
Options
- Asource port
- BToS
- Cprotocol type
- Dsource IP
How the community answered
(61 responses)- A3% (2)
- B80% (49)
- C10% (6)
- D7% (4)
Explanation
NetFlow identifies a flow using a 7-tuple key: source IP, destination IP, source port, destination port, Layer 3 protocol type, input interface, and ToS (Type of Service / DSCP byte). The ToS field is included in the NetFlow key to differentiate flows that may share the same 5-tuple but carry different traffic classes. NBAR (Network-Based Application Recognition) classifies applications based on Layer 3 protocol type, Layer 4 port numbers, and Layer 7 application payload inspection - it does not use the ToS byte as a classification criterion. Source port (A), protocol type (C), and source IP (D) are all used by both NetFlow and NBAR for identification and classification purposes.
Topics
Community Discussion
No community discussion yet for this question.