01 02 03 04 05
Ignix Insights · Paper 04 of 05

NetFlow Analysis & Threat Detection:
A Technical Deep-Dive

March 2026
12 min read
IT professionals · MSP engineers · Technical decision makers

This paper goes under the bonnet. It's for the technical reader who wants to understand the mechanics: what NetFlow data actually contains, how AI-driven analysis works at a protocol level, what specific threat patterns are detectable, and how Ignix's architecture turns raw flow records into actionable intelligence.

NetFlow Fundamentals

NetFlow is a network protocol originally developed by Cisco in the mid-1990s for traffic accounting. It has since become the de facto standard for network traffic metadata collection across virtually all enterprise-grade networking equipment.

A NetFlow record represents a unidirectional sequence of packets sharing common attributes — what the protocol defines as a "flow." Critically, NetFlow captures metadata about connections, not payload content. It tells you that Device A communicated with Server B using Protocol C and transferred X bytes at Time Y. It does not tell you what was said.

The Anatomy of a Flow Record

A standard NetFlow v5 record contains the following fields:

Source IP addressWho initiated the connection
Destination IP addressWhere the connection went
Source portOriginating application/service
Destination portTarget application/service
IP protocolTCP, UDP, ICMP, etc.
Packet countNumber of packets in the flow
Byte countTotal data transferred
Start / End timestampWhen the flow began and terminated
TCP flagsSYN, ACK, FIN, RST — connection state indicators
Input/Output interfacePhysical port on the firewall

NetFlow v9 and its IETF-standardised successor IPFIX extend this significantly with template-based records that can include application identification, VLAN tags, IPv6 addresses, MAC addresses, and vendor-specific extensions.

Protocol Variants by Vendor

Flow Export Support by Firewall Vendor
Cisco NetFlow v5, v9, Flexible NetFlow
Fortinet sFlow, NetFlow v9, IPFIX
Palo Alto NetFlow v9, IPFIX
SonicWall NetFlow v5, v9, IPFIX
WatchGuard NetFlow v9
MikroTik IPFIX (native, excellent SMB support)
Juniper J-Flow (functionally equivalent to NetFlow v9)
HP/Aruba sFlow

# sFlow uses statistical sampling rather than complete flow tracking.
# For SMB traffic volumes, NetFlow/IPFIX provides richer security data.

Collection Architecture

┌──────────────┐ NetFlow/IPFIX (UDP 2055) ┌───────────────────┐
│ │ ──────────────────────────→ │ │
Client(encrypted tunnelIgnix Central
Firewallor direct export)Analysis Platform
│ │ │ │
└──────────────┘ └────────┬──────────┘
┌────────▼──────────┐
│ │
AI Analysis
Engine (Claude)
│ │
└────────┬──────────┘
┌────────▼──────────┐
│ Plain-English │
│ Reports + Alerts │
└────────────────────┘

The client's firewall is configured to export NetFlow records to the Ignix collection endpoint. For most firewalls, this is a straightforward configuration entry pointing the NetFlow exporter at the collector IP and UDP port. The entire process takes 5 to 15 minutes for an experienced IT professional.

Data Volumes

A typical 50-person office generates roughly 500,000 to 2,000,000 flow records per day. Each flow record is approximately 48 bytes (NetFlow v5) to 200 bytes (IPFIX with extensions). Daily data volumes for a typical SMB sit in the range of 25MB to 400MB — trivial relative to modern storage and bandwidth. The processing overhead on the firewall itself is negligible.

The Analysis Pipeline

Stage 1: Ingestion and Enrichment

Flow records arrive in different formats and are normalised to a common schema, then enriched with contextual data:

Stage 2: Behavioural Baseline Modelling

During an initial learning period of 7 to 14 days, the analysis engine builds a behavioural model of the client's network. This model is per-client and continuously updated — it's not a generic threat model but a profile of what "normal" looks like for this specific organisation:

Stage 3: Anomaly Detection

Multiple detection methodologies run simultaneously against the established baseline:

Detection Methodologies
Statistical anomaly
Volume deviations, temporal outliers, rate anomalies
Example: device normally 100MB/day → spikes to 5GB

Behavioural anomaly
Qualitative changes vs established profile
Example: workstation using FTP for first time

Threat pattern heuristics
C2 beaconing: regular intervals, consistent packet sizes
DNS tunnelling: anomalous query volumes, long subdomains
Lateral movement: internal scanning on management ports
Data staging: slow accumulation then large transfer
Cryptomining: persistent high-throughput to pool IPs

IOC matching
Cross-reference against known threat infrastructure
Newly identified C2 servers, active campaign IPs

Stage 4: AI Contextualisation and Reporting

Detected anomalies, enriched with contextual data, are passed to the Claude AI for interpretation and report generation. The AI performs severity assessment, narrative generation in plain English, trend analysis across time, and compliance mapping to relevant frameworks.

Detection Capabilities in Practice

Scenario 01
Compromised VPN Credentials and Reconnaissance
What the firewall sees

A successful VPN authentication using valid credentials. The firewall permits the connection — a valid login is a valid login. No alert generated.

What Ignix detects

A VPN session from a geographic location never previously associated with this network. Session occurs outside established working hours. The connected device immediately begins scanning multiple internal hosts on ports 445, 3389, and 22 — entirely inconsistent with the user's historical behaviour.

⚠ Alert: VPN session from unusual origin (geolocated: outside normal patterns).
Post-connection activity shows internal port scanning across 47 hosts.
Pattern consistent with post-compromise reconnaissance.
Recommended: Terminate VPN session, reset credentials, enable MFA.

Cloud-only attacks — an honest limitation. If an attacker accesses Microsoft 365 credentials and operates entirely from outside your network, that activity generates no traffic through your firewall. Ignix won't see it. This is where Microsoft's own tools — Entra ID sign-in logs, Conditional Access, Identity Protection — are the right defence. Ignix detects the consequences that touch your network: unusual data sync volumes, anomalous device behaviour following credential theft, or an attacker who pivots from cloud access to VPN access. Both layers together cover the full picture.

Scenario 02
Pre-Ransomware Reconnaissance
What the firewall sees

Internal SMB and RDP traffic — normally permitted by firewall rules. Nothing unusual flagged.

What Ignix detects

A sudden spike in internal connection attempts from a single device to multiple IPs on ports 445, 3389, and 135. The device's historical profile shows it has never previously initiated connections to more than 3–4 internal hosts. Sequential IP probing with short connection durations is consistent with automated reconnaissance.

⚠ Alert: Internal scanning detected from 192.168.1.23.
47 internal hosts probed in 12 minutes on management ports.
Pattern consistent with pre-ransomware reconnaissance.
Recommended: Isolate device immediately, initiate malware investigation.
Scenario 03
Shadow IT and Data Leakage
What the firewall sees

HTTPS traffic to a legitimate cloud storage service. No alert — the service isn't on any blocklist.

What Ignix detects

Multiple devices connecting to a cloud storage provider that has never previously appeared in traffic. Upload volumes are significant and growing week-over-week. Traffic occurs during business hours and is concentrated in a specific department.

⚠ Finding: Unsanctioned cloud storage usage detected — 6 devices, 3.2GB uploaded over 5 days.
Service not in approved application inventory.
Recommended: Review with department — either sanction and ensure GDPR compliance, or block.
Scenario 04
DNS-Based Data Exfiltration
What the firewall sees

DNS traffic on port 53 to the configured resolver. Normal, expected traffic — no alert.

What Ignix detects

A single device generating anomalous DNS query volume — far above its baseline. Queries target a single domain with extremely long, random-looking subdomain strings. The destination domain was registered recently and resolves to no legitimate business service.

⚠ High severity: DNS tunnelling pattern detected from 192.168.1.55.
1,840 queries in 4 hours to attacker-domain.com with encoded subdomains.
Domain registered 3 days ago. Pattern consistent with data exfiltration.
Recommended: Isolate device immediately, forensic investigation required.
Scenario 05
IoT Device Compromise
What the firewall sees

Outbound traffic from a device IP. Depending on configuration, may or may not be blocked — but no signature match, no alert.

What Ignix detects

A CCTV camera that historically generates minimal, predictable traffic (periodic manufacturer cloud connections) suddenly begins making hundreds of outbound connections per hour to diverse IPs across multiple countries. The pattern — short-duration, distributed destinations — is characteristic of DDoS botnet participation.

⚠ Alert: IoT device (192.168.1.78 — likely CCTV) exhibiting botnet behaviour.
340 connections/hour to 18 different countries — vs baseline of 2/hour.
Recommended: Isolate device, update firmware, review IoT network segmentation.

Privacy and Data Handling

NetFlow's use of metadata rather than deep packet inspection is a deliberate architectural choice that directly addresses privacy concerns. Ignix detects that a device uploaded 500MB to a suspicious service without knowing what files were uploaded. It identifies regular connections to a suspicious server without reading the data exchanged.

For organisations subject to GDPR, this is a significant advantage. Network metadata analysis achieves security monitoring objectives without processing personal communications content — substantially reducing the data protection impact assessment requirements compared to deep packet inspection or email monitoring solutions.

Technical Summary

ComponentDetail
Data sourceNetFlow v5/v9, IPFIX, sFlow from client firewalls
CollectionCentralised collector on hardened EU infrastructure
TransportUDP (standard) or encrypted tunnel (optional)
EnrichmentGeoIP, ASN, passive DNS, threat intelligence feeds
BaselinePer-client behavioural model, continuously updated (7–14 day learning period)
DetectionStatistical anomaly, behavioural anomaly, threat pattern heuristics, IOC matching
AnalysisClaude AI for contextualisation, severity assessment, and narrative generation
OutputPlain-English reports, real-time email alerts, compliance-mapped findings
PrivacyMetadata only — no payload inspection, no content capture
DeploymentFirewall configuration change only — no agents, no hardware
Multi-tenancyLogical isolation per client, MSP-ready architecture

Take a closer look

If you're an IT professional or MSP evaluating Ignix, we're happy to walk through the technical architecture in detail, run a proof-of-concept, or provide sample reports from anonymised client data.

hello@ignix.co.uk