NetFlow, sFlow, and IPFIX export records over UDP with no authentication, so a collector accepts flow records from anyone who can reach it. An attacker therefore forges records: crafting flow datagrams that describe conversations that never happened. Fabricated flows poison the monitoring picture, injecting false traffic to mislead capacity planning and security analytics, drowning or misattributing real flows, and planting evidence of connections that frame a host or hide activity in noise. IPFIX and NetFlow v9 are template-based (the exporter first sends a template describing the record layout, then data records referencing it), and parsing those attacker-controlled templates and records is a surface in itself: malformed templates and length fields have produced memory-corruption and denial-of-service vulnerabilities in collectors.
# forge a NetFlow/IPFIX datagram to the collector (UDP); craft header + records
# scapy has NetflowHeader/NetflowRecord layers; example sketch:
python3 - <<'PY'
from scapy.all import IP, UDP, send
from scapy.layers.netflow import NetflowHeader, NetflowHeaderV5, NetflowRecordV5
pkt = IP(dst="<collector>")/UDP(sport=1234, dport=2055)/ \
NetflowHeader()/NetflowHeaderV5(count=1)/ \
NetflowRecordV5(src="10.0.0.5", dst="10.0.0.9", dpkts=1000, doctets=1000000)
send(pkt, verbose=0)
PY
# crafted IPFIX/v9 templates with inconsistent field lengths probe collector parsing bugs
Exploitation notes#
- Spoofed flows mislead whatever is built on the data: capacity dashboards, baselines, and flow-based detection, so forgery is used to fabricate traffic (frame a host, hide real flows in noise) or to create false indicators.
- The collector trusts the exporter's source and template; port 2055/4739 (common NetFlow/IPFIX) over UDP has no authentication, so reachability is the only precondition.
- The template/record parser is a memory-safety surface: crafted IPFIX/NetFlow v9 templates with bad length or field counts have crashed or exploited collectors, so a flow listener is also an exploitation target, match the collector software to its advisories.
- Pair with collector data harvesting: read the real map first, then forge flows that blend in or misdirect.