Resumen de Cisco flow logs and intrusion detection at the Ohio State University
Many Cisco router support NetFlow accounting, which provides fast accesss-control list proccessing, accounting and switching/routing with minimal impact on performance. One of the side benefits of enabling flow routing is that you can then "capture" a record on the flows as they are removed from the flow cache, creating we call a "flow log". Among other things, the flow logs contain the source and destination IP addresses for all IP packets, source and destination port numbers for UDP and TCP traffic, and packet and octet counts.
