Full packet capture answers "what exactly was said?" Flow data answers "who talked to whom, how much and when?" At scale, the second question is often the one you can afford to ask.
What a flow record contains
- source and destination IP;
- source and destination port;
- protocol;
- bytes and packets;
- start and end time;
- input/output interfaces;
- sometimes application or user metadata.
No payload. That is the trade-off: smaller storage, less detail.
Flow versus packet capture
| Question | Best source |
|---|---|
| Which hosts talked to a suspicious IP? | Flow logs |
| What was in the HTTP request? | Packet capture |
| How much data left the network? | Flow logs |
| Did TLS complete? | Packet capture or TLS logs |
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.