What is IPFIX?

IP Flow Information Export (IPFIX) is an IETF standard protocol for exporting flow and log records from network devices to collection systems. Derived from Cisco’s NetFlow Version 9, it defines a template-based binary format that VOS devices use to stream traffic and log data to Versa Analytics nodes and third-party NetFlow-compatible collectors.

Key takeaways

• IPFIX is the IETF standard format for exporting flow and log data.
• It evolved from Cisco’s proprietary NetFlow Version 9 export format.
• Templates describe record fields, so collectors need no prior knowledge.
• VOS devices export IPFIX to Versa Analytics nodes and NetFlow collectors.
• IPFIX is sometimes called NetFlow Version 10 because of that lineage.

On this page: Why it matters · How it works · Types · IPFIX & Versa · FAQ

Why is IPFIX important?

Network and security operations depend on visibility into traffic flows, and that visibility only scales if devices from different vendors export it in a common format. Before IPFIX, flow-export formats were mostly proprietary, so a collector built for one vendor’s records often could not parse another’s. Standardizing the format under the IETF let analytics platforms, SIEMs, and NetFlow collectors accept flow data from any compliant exporter without custom parsing.

IPFIX’s template-based design also matters operationally: because a device sends the record layout once and reuses it, exporters can add fields – a security tag, an application identifier – without breaking older collectors that simply ignore what they don’t recognize. That extensibility is why IPFIX remains the default export format for flow analytics, capacity planning, and security investigation across multi-vendor SD-WAN fabrics reporting on hundreds of branch devices at once.

What is IPFIX?

IPFIX defines two record types that flow together in the same stream. A template record describes the structure of the data that follows: which fields are present, in what order, and how many bytes each occupies. A data record then carries the actual values – source and destination addresses, ports, protocol, byte and packet counts – matched to the most recently sent template with that ID. Because the template travels with the data, a collector can parse any exporter’s stream without hardcoding field layouts in advance.

Fields come from an IANA-maintained registry of Information Elements, plus vendor-specific elements exporters define themselves. An exporting process on the device buffers and transmits records; a collecting process on the far end receives and stores them, typically over UDP, TCP, or SCTP. IPFIX is specified in IETF RFC 7011, with the field registry defined in RFC 7012.

Types of IPFIX

Beyond basic data records, IPFIX defines an options template for metadata about the export process itself – sampling rates or exporter identity – rather than about traffic. This lets a collector interpret sampled data correctly without a separate side channel.

Versioning matters in practice. Cisco’s NetFlow Version 9 introduced the template concept; IPFIX standardized that model under IETF governance, which is why it is informally called NetFlow Version 10. Vendors can still extend the template with proprietary Information Elements while staying wire-compatible with generic collectors, since unrecognized fields are simply skipped. Collector implementations vary in which template versions they accept, so pairing an exporter with an unfamiliar collector is worth checking in advance.

IPFIX & Versa

VOS devices export operational and security logs in IPFIX format wherever high-volume flow data needs to reach a collector without vendor-specific customization. Log export functionality (LEF) forwards logs to Analytics log collector nodes and third-party NetFlow collectors over LEF connections, configured through a log export template, collector, and LEF profile that ties a feature or service to a destination. On the receiving side, an Analytics log collector node runs a log collector exporter that accepts these connections and can define local and remote collectors and exporter rules to store or forward logs before the Analytics driver ingests them. Tenant administrators reach equivalent functionality from Concerto via reusable logging profiles, which bundle collector groups across services. VOS IPFIX templates also carry Versa vendor fields – tenant ID, application ID – for multi-tenant analytics.

Frequently asked questions

What is the difference between IPFIX and NetFlow?

IPFIX is the IETF-standardized evolution of Cisco’s proprietary NetFlow Version 9; it keeps the same template-based, self-describing structure but is vendor-neutral and extensible through an IANA-registered field set. Because of that lineage, IPFIX is sometimes informally called NetFlow Version 10.

Why does IPFIX use templates instead of a fixed record format?

Templates let an exporter describe field order and length once, then send only values afterward, which is more efficient than repeating labels per record. It also lets collectors parse any exporter’s stream, standard or vendor-extended, without hardcoding that vendor’s specific field layout in advance.

What transport protocols does IPFIX use?

IPFIX can run over UDP, TCP, or SCTP; the exporter and collector agree on one for a given session. VOS log export functionality supports UDP and TCP connections between devices and Analytics nodes or NetFlow-compatible collectors, depending on how the collector is configured.

Can IPFIX logs go to more than one collector?

Yes. VOS supports collector groups for high availability, where logs stream to one active member at a time, and collector group lists that chain multiple groups together so the same logs reach several independent destinations – for example, an Analytics cluster and a third-party SIEM – at once.

Does IPFIX carry security data, or only flow statistics?

Both. Beyond basic flow statistics like addresses, ports, and byte counts, VOS IPFIX exports include log types such as firewall, IDP, and URL-filtering events, tagged with vendor fields like application ID and tenant ID, so collectors receive security context alongside traffic volume.

More on IPFIX

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about IPFIX, these are worth looking at next.