Four names, one job: tell a collector which conversations crossed the router and how big they were. The differences between NetFlow v5, v9, Flexible NetFlow, and IPFIX are not academic trivia, because picking the wrong one means either losing the fields you need or paying for a collector license you did not have to.
Here is what actually separates them, and how to decide. For the hands-on configuration, see Flexible NetFlow on Cisco IOS XE; for the wider context, the IP Services cluster guide.
The Short Version
The single most important line in that grid: Flexible NetFlow is not a protocol. It is the configuration model on the router. When you configure FNF, what leaves the box is still NetFlow v9 (or IPFIX, if you ask for it). People compare "v9 vs Flexible NetFlow" as if they are alternatives. They are not. They are different layers.
NetFlow v5: The Fixed Record
v5 exports a fixed 48-byte record with a fixed set of fields, in a fixed order. There is no negotiation and no template. The collector knows the layout because the layout is in the RFC-adjacent spec and never changes.
That simplicity is its virtue and its ceiling. The fields you get are the classic ones: source and destination IPv4 address, source and destination port, protocol, ToS, TCP flags, input and output interface index, packet and byte counts, start and end timestamps, next-hop, and source and destination AS.
What you cannot get, ever:
- IPv6. The address fields are 32 bits. There is nowhere to put a v6 address. This alone disqualifies v5 from any modern network.
- MPLS labels, VLAN IDs, MAC addresses, DSCP as a first-class field.
- Any custom key. You cannot say "I want to key on VLAN," because the record is what it is.
v5 survives because it is trivially easy to parse and every collector on earth supports it. If you have an old device that speaks nothing else, it still works. Do not design anything new around it.
NetFlow v9: Templates Change Everything
v9 solved the rigidity problem by separating the description of the data from the data itself. The router periodically sends a template record that says "field 1 is a 4-byte source IPv4 address, field 2 is a 4-byte destination address, field 3 is a 2-byte source port..." and then sends data records that are just values in that order.
You can watch it happen. Here are two consecutive export packets from the lab, captured on the collector:
j@llmbits:~$ sudo tcpdump -i ens224 -n udp port 2055
18:44:51.294654 IP 192.168.99.1.58769 > 192.168.99.100.2055: UDP, length 296
18:44:52.295245 IP 192.168.99.1.58769 > 192.168.99.100.2055: UDP, length 132296 bytes then 132 bytes. The first is the template (bulky, because it names every field). The second is data (compact, because it does not). Every subsequent data packet is small, and the template is only resent periodically.
This design has one sharp edge that causes most real-world v9 problems: if the collector misses the template, it cannot decode anything. Not "it decodes partially." Nothing. The data packets are an undifferentiated pile of bytes without the template to give them meaning.
This is why the export configuration includes:
R1(config-flow-exporter)# template data timeout 60Sixty seconds is the worst case a restarted collector will sit blind. The default on many platforms is 600, which means a collector that restarts at the wrong moment produces a ten-minute hole in your data and nobody notices until someone asks about that hole in the graph.
The upside of templates is that v9 can carry anything Cisco chooses to define: IPv6 addresses, MPLS label stacks, VLAN tags, MAC addresses, BGP next-hop, and so on. The record in the lab exports interface names, ToS, and 64-bit byte counters, none of which v5 could express.
Flexible NetFlow: The Configuration Model
FNF is what Cisco gave you on the router so you could actually exploit v9's flexibility. Rather than picking from a menu of pre-baked record types, you build the record yourself out of match (key) and collect (non-key) fields.
R1#show flow record PINGLABZ-IPV4
flow record PINGLABZ-IPV4:
No. of users: 1
Total field space: 54 bytes
Fields:
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
collect interface input
collect interface output
collect counter bytes long
collect counter packets long
collect timestamp absolute first
collect timestamp absolute lastThat record is impossible in v5 and it is a routine afternoon in FNF. And it exports as v9:
R1#show flow exporter PINGLABZ-COLLECTOR
Flow Exporter PINGLABZ-COLLECTOR:
Export protocol: NetFlow Version 9
Transport Configuration:
Destination IP address: 192.168.99.100
Transport Protocol: UDP
Destination Port: 2055
Export template data timeout: 60So when someone asks "are you running Flexible NetFlow or v9," the correct answer is usually "yes." FNF is how you configured it; v9 is what is on the wire.
IPFIX: The Standard
IPFIX (RFC 7011) is the IETF's standardisation of v9, and it is sometimes called NetFlow v10 for that reason. It keeps the template model and adds:
- Vendor-specific Information Elements. A vendor can define its own fields under its own enterprise number without colliding with anyone else. This is how modern telemetry (application IDs, URLs, user identity) rides along.
- Variable-length fields. v9 fields are fixed-length. IPFIX can carry a hostname or a URL, which have no fixed length.
- Transport flexibility. The RFC prefers SCTP for reliability, and permits TCP and UDP. In practice, essentially everyone runs it over UDP anyway.
- Multi-vendor by design. Juniper, Huawei, Palo Alto, nProbe, and open-source exporters all speak IPFIX. v9 is a Cisco protocol that others chose to implement.
On IOS XE, switching from v9 to IPFIX is one line in the exporter:
R1(config-flow-exporter)# export-protocol ipfixThe record, the monitor, and the interface config do not change at all. That is the FNF payoff: the wire format is a detail you can swap.
Which One Do I Use?
The honest default for most enterprises: configure with Flexible NetFlow, export v9, and switch the single export-protocol line to IPFIX the day a non-Cisco device shows up. Because the record definition is separate from the wire format, that migration costs you one line and a collector setting.
A Note on sFlow, Which Is Not NetFlow
sFlow is frequently mentioned in the same breath and it is a fundamentally different thing. NetFlow (all versions) maintains a flow cache: the router tracks conversations and exports summaries. sFlow does not track flows at all; it randomly samples packets and ships packet headers to the collector, which reconstructs a statistical picture.
Consequences: sFlow is cheaper on the device (no cache to maintain, which is why it is common on merchant-silicon switches), always sampled (so never a complete record), and gives you packet headers rather than flow summaries. NetFlow gives you complete flow records (if unsampled) and is more expensive to produce.
For security forensics, unsampled NetFlow wins. For "which port is hot on my 48-port switch," sFlow is fine and free.
FAQ
Is Flexible NetFlow a protocol?
No. It is the IOS configuration framework (records, exporters, monitors). It exports NetFlow v9 by default and IPFIX on request. This is the single most common misconception about it.
Is IPFIX just NetFlow v10?
Effectively yes, and the version field in the header does say 10. It is the IETF standardisation of v9 with variable-length fields and vendor IEs added.
Can one exporter send both v9 and IPFIX?
Not the same exporter; export-protocol is a single setting. But you can define two exporters and attach both to the same monitor, which sends the same flows to two collectors in two formats. Useful during a migration.
Why does my collector show nothing even though the router says it is sending?
Almost always a template problem. The collector started after the last template and is waiting for the next one. Lower template data timeout and restart the collector.
Does v9 support IPv6?
Yes, fully. v5 does not, and cannot. If your network has IPv6 (see the IPv6 cluster guide), v5 is already lying to you about your traffic.
Key Takeaways
- Flexible NetFlow is a config model, not a wire protocol. It exports v9 or IPFIX. Comparing "v9 vs FNF" is a category error.
- v5 is fixed-format and IPv4-only. It cannot carry an IPv6 address, ever. Legacy only.
- v9 introduced templates, which is what makes IPv6, MPLS, and VLAN fields possible. Miss the template and the collector decodes nothing.
- IPFIX is the IETF standard version of v9, with variable-length fields and vendor IEs. Choose it for multi-vendor or app-aware telemetry.
- Switching v9 to IPFIX is one line (
export-protocol ipfix) because FNF separates the record from the wire format. - sFlow is not NetFlow. It samples packets rather than tracking flows. Cheaper, always sampled, different tool.
Next: configure Flexible NetFlow end to end, or the IP Services cluster guide.
