Interface counters say how much; NetFlow says who talks to whom, how, when. Flows are keyed on the classic 7-tuple minus two (src/dst IP, src/dst port, protocol, ToS, interface), counted in a cache and exported to a collector when the flow ends or times out.

• v5 fixed format; v9 template-based; Flexible NetFlow = build your own: record (what), exporter (where), monitor (where applied).
• Unidirectional by design — bidirectional views are collector-side math.
• Needs CEF; costs CPU/memory — sample on fast links, don’t enable everywhere.

flow record R
 match ipv4 source address
 match ipv4 destination address
 collect counter bytes
flow exporter E
 destination 10.10.10.10
flow monitor M
 record R
 exporter E
interface Gi0/1
 ip flow monitor M input

Symptoms: collector silent → exporter IP/ACL; missing IPv6 → record lacks ipv6 matches. NetFlow ≠ packet capture — it’s statistics, not payloads (that’s SPAN/ERSPAN’s job).