Which three statements about NetFlow version 9 are correct? (Choose three.)
Click on the arrows to vote for the correct answerA. B. C. D. E.
NetFlow is a protocol used for collecting and analyzing network traffic data. Version 9 of NetFlow is an updated version that introduced several improvements over previous versions. Here are the correct statements about NetFlow version 9:
A. It is backward-compatible with versions 8 and 5. This statement is correct. NetFlow version 9 is designed to be backward-compatible with earlier versions of NetFlow, including versions 8 and 5. This means that devices that support version 9 can also support earlier versions of the protocol.
C. A version 9 export packet consists of a packet header and flow sets. This statement is correct. In NetFlow version 9, data is exported in packets consisting of a header and one or more flow sets. The header contains information about the NetFlow exporter and the flow sets contain information about the flows being analyzed, such as the source and destination IP addresses, source and destination ports, and protocol used.
D. Generating and maintaining valid template flow sets requires additional processing. This statement is correct. NetFlow version 9 introduced the concept of template flow sets, which allow for more flexibility in the types of data that can be collected and exported. However, generating and maintaining valid template flow sets can be more complex and require additional processing compared to earlier versions of NetFlow.
The other statements are incorrect:
B. Version 9 is dependent on the underlying transport; only UDP is supported. This statement is incorrect. NetFlow version 9 is not dependent on the underlying transport protocol and can use any transport protocol. However, UDP is commonly used due to its low overhead and connectionless nature.
E. NetFlow version 9 does not access the NetFlow cache entry directly. This statement is incorrect. NetFlow version 9 does access the NetFlow cache entry directly to collect and export data, just like earlier versions of the protocol.