For the traffic passing through a router, you want to find out how many bytes are taken up by each combination of source and destination (addresses, port numbers and protocol), aggregated per stream of traffic. Which mechanism is the most appropriate to use?

Answer: C. NetFlow (IPFIX)

NetFlow, and IPFIX, the standard based on it, record the packet count, byte count, times and so on for each group of packets with the same source and destination addresses, port numbers and protocol (each flow), and send the records to a collector server. They are used to find which hosts or applications are using bandwidth and to spot unusual traffic. SNMP is a protocol for querying values such as per-interface traffic and CPU usage on equipment and for having equipment report problems (traps); it cannot tell whose traffic it is. syslog sends events such as links going down or logins as text messages to a logging server.

• A. SNMP shows totals such as the traffic on each interface, not which source and destination the traffic is between.
• B. syslog sends messages about events on the equipment; it does not aggregate traffic per address combination.
• C. Correct. It records and exports packet and byte counts for each flow.