Advanced Search

Content Type


Publication Date

Network Profiling Using Flow

  • Author(s): Austin Whisnant, Sid Faber
  • Publish Date:
  • Publisher: Software Engineering Institute
  • SEI Identifier: CMU/SEI-2012-TR-006
  • Type: Technical Report
  • Topics: Network Situational Awareness
  • Description: In this report, the authors provide a step-by-step guide for profiling and discovering public-facing assets on a network using netflow data.


This report provides a step-by-step guide for profiling—discovering public-facing assets on a network—using network flow (netflow) data. Netflow data can be used for forensic purposes, for finding malicious activity, and for determining appropriate prioritization settings. The goal of this report is to create a profile to see a potential attacker’s view of an external network. Readers will learn how to choose a data set, find the top assets and services with the most traffic on the network, and profile several services. A case study provides an example of the profiling process. The underlying concepts of using netflow data are presented so that readers can apply the approach to other cases. A reader using this report to profile a network can expect to end with a list of public-facing assets and the ports on which each is communicating and may also learn other pertinent information, such as external IP addresses, to which the asset is connecting. This report also provides ideas for using, maintaining, and reporting on findings. The appendices include an example profile and scripts for running the commands in the report. The scripts are a summary only and cannot replace reading and understanding this report.

Listen to the podcast from CERT's Podcast Series about this report.

Cite This Report

Show Citation Formats


Whisnant, Austin; & Faber, Sid. Network Profiling Using Flow (CMU/SEI-2012-TR-006). Software Engineering Institute, Carnegie Mellon University, 2012.


Whisnant. Austin, and Faber. Sid, "Network Profiling Using Flow," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, Pennsylvania, Technical Report CMU/SEI-2012-TR-006, 2012.


Whisnant, Austin., & Faber, Sid. (2012). Network Profiling Using Flow (CMU/SEI-2012-TR-006). Retrieved November 25, 2014, from the Software Engineering Institute, Carnegie Mellon University website:


Austin Whisnant, & Sid Faber. Network Profiling Using Flow (CMU/SEI-2012-TR-006). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2012.


Whisnant, Austin., & Faber, Sid. 2012. Network Profiling Using Flow (Technical Report CMU/SEI-2012-TR-006). Pittsburgh: Software Engineering Institute, Carnegie Mellon University.