Cybersecurity and Response Planningintermediate
Explain why NetFlow can be an effective alternative to full-packet capture during traffic analysis.
Answer
Full-packet capture provides detailed packet contents but can create storage and maintenance costs that are too high for broad deployment. NetFlow captures traffic origin, destination, and amount, offering useful traffic information with less emphasis on retaining full packet contents. Organizations can select it when that level of information meets their monitoring and investigation needs.
Explanation
### The concept
Full-packet capture records complete packet data and is described as an ideal method for traffic analysis, but large storage volumes can make it costly to store and maintain. NetFlow provides a more focused view: traffic origin, destination, and amount. It can therefore be effective when investigators need traffic-flow information but cannot justify collecting full packet contents everywhere. The choice should reflect the monitoring strategy and use case.
### What a good answer covers
- State that full-packet capture is detailed and useful for analysis.
- Explain its storage and maintenance costs.
- Describe the traffic information captured by NetFlow.
- Connect the choice to organizational needs and specific use cases.
### Terms
- **NetFlow**: A method for recording network traffic flow information.
### Remember
Choose capture depth according to the evidence needed and the cost of retaining it.
Related Questions
- Which of the following is an example of an adversary attack activity, as opposed to a system vulnerability or a defensive measure? (Select all that apply.)(intermediate)
- Which information is most directly useful when coordinating technical response across teams?(basic)
- Attackers necessarily complete all life-cycle stages quickly, so extended monitoring is unnecessary.(basic)
- The foundational three-stage model of organizational change consisting of Unfreeze, Change, and Refreeze was introduced by social psychologist Kurt _____.(basic)
- Select ALL elements that belong in a documented cyber risk assessment.(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free