cisco certification for networking

cisco certification for networking.TCP tagging and encapsulation protocol (TCP/UDP). The contents of the packet (for deep packet inspection).All field values of the IPv4 packet header. including ID and TTL field values. All field values of the IPv6 packet header, including the "Flow Label" field value and the individual field values of the "Optional Header".Routing information, such as next-hop address, source autonomous system number (ASN), destination ASN, source prefix mask, destination prefix mask, Border Gateway Protocol (BGP) next-hop, and BGP policy accounting traffic index.2.4.2 NetFlow and Packet GrabbingThere is a significant difference between the information obtained by packet grabbing and the information collected by NetFlow. One can think of NetFlow (ii)can be thought of as a data collection technique that captures metadata about all transactions/flows traversing the network.Capturing packets within a network means "capturing" or recording a mirror of packets as they flow through the network. Cisco switches support mirrored port configurations without compromising their forwarding performance. Typically, a host with a Deep Packet Inspection (DPI) application installed is connected to the mirror port of the switch, and the DPI application extracts certain information from the packets, intended to analyze various events that occur in the network. DPI applications range from open source packet capture software (e.g., Wireshark) to commercial software with full packet analysis capabilities. The reader may ask: "What is the difference between NetFlow and traditional packet capture techniques (which rely on SPAN ports or Ethernet tee devices [Ethernet tap])?" Packet capture analysis is more expensive and requires a larger amount of data. In many cases, and in most situations, with a properly configured NetFlow capture and analysis ecosystem, there is no need to enable heavyweight packet capture anywhere in the network. In fact, even if you do need to enable heavyweight packet capture, it is likely to be unaffordable. For example, the storage space and computing power required to fully analyze all the packets captured from the network would cost a fortune. Of course, there are certainly benefits to capturing all the packets traversing the network and performing a comprehensive analysis.If packet capture is really necessary, a device called FlowSensor, from Lancope, a company acquired by Cisco, can be plugged into a SPAN, tap, or mirror port to make it generate NetFlow information that can be read by any collector that supports NetFlow v9.2.4.3 NetFlow Cache There are three types of NetFlow caches as follows.148 Chapter 2 Network Security Appliances and Cloud Services