Cisco NetFlow Collection Engine

Cisco NetFlow Collector 6.0

  • Viewing Options

  • PDF (102.7 KB)
  • Feedback

Product Overview

Cisco ® NetFlow Collector (NFC) 6.0 is a NetFlow data collection and aggregation product that supports data analysis and reporting. Cisco NFC empowers enterprises and service providers with actionable intelligence to optimize their network infrastructure for application delivery and network capacity planning. In addition, Cisco NFC is a critical enabler for business support applications such as usage-based billing and service-level objective (SLO) monitoring.
Cisco NFC delivers industry-leading performance for helping enable network engineers to cope with the high-volume flow data typical in large networks. It implements a scalable multitier architecture for collecting, normalizing, correlating, and aggregating data from NetFlow-enabled devices dispersed across geographically distributed networks. The architecture comprises two layers: Cisco NFC as the first tier and Multi-NFC (MNFC) as the new tier-two component. Cisco MNFC adds network-level correlation and time-based summarization, providing a central view for all distributed Cisco NFC implementations in the network. Typically, Cisco MNFC is deployed at the administrative control point of the network.
In keeping with the latest Cisco NetFlow enhancements, Cisco NFC supports all NetFlow formats. It also supports correlation across multiple data sources such as Border Gateway Protocol (BGP) peering for Virtual Route Forwarding (VRF) resolution. In addition to supporting a large selection of predefined aggregation schemes, Cisco NFC offers the flexibility for users to define their own aggregation schemes. Configuration and traffic reports are delivered through an advanced user-friendly Web interface.
Cisco NFC supports standard and open interfaces and easily integrates with other report analysis applications.
Table 1 lists the features of Cisco NFC 6.0, and Table 2 gives the specifications for Cisco NFC 6.0.

Table 1. Features



Cisco NetFlow Collector 6.0

Flexible aggregation scheme builder

Allows users to choose the aggregation that best solves their problem by selecting the most relevant keys and values. The user is not restricted to using predefined aggregation schemes.

BGP peering

Correlates NetFlow data with BGP attributes. The user can collect the amount of flows from one peering device or devices to another.

V1-V9 NetFlow format

Supports all versions of Cisco IOS® Netflow. Cisco NFC supports Flexible NetFlow.

Threshold setting

Allows creation of threshold parameters for correlation analysis. When triggered, Cisco NFC sends a Simple Network Management Protocol (SNMP) trap to a designated northbound application.

Raw flow forwarding: "flow through"

Cisco NFC can be used to transparently forward raw flows (NetFlow Data Export [NDE] packets) to multiple NetFlow applications.

SNMP trap

Supports the use of SNMP traps to integrate with end-user applications.


Cisco NFC 6.0 has built-in FlexLM licensing. One license key is required per server. The license key is node-locked based on the IP address of the server.

Health monitor

Monitors and provides visibility into the health of Cisco NFC by observing resource utilization within the server and application.

Performance enhancement

Cisco NFC 6.0 provides a significant boost in performance.

For more information, visit

Flexible NetFlow (FNF)

Cisco NFC supports Flexible NetFlow. FNF is the next generation in flow technology. FNF offers flexibility and scalability of flow data beyond traditional NetFlow. It supports configurable flow information to perform customized traffic identification.

Cisco Multi-NFC (MNFC) 6.0

NF-Egress: Packets lost and site in-out traffic summary

Cisco MNFC monitors packets lost from IP-IP flows. Customers can use this feature to monitor the point of failure of each link in the network.

PE-PE, PE-CE, CE-PE, and CE-CE traffic reports

Provides traffic statistics between two IP networks and sites. Cisco MNFC is the first in the market to provide CE-CE monitoring for enterprise customers.

Correlation traffic summary VPN/VRF, VPN/non-VPN

Cisco MNFC provides a view of traffic statistics on a per VPN-site basis. Users can classify and report site to site and perform VPN traffic summarization.

Embedded database

Cisco MNFC contains an Informix database to store files from multiple distributed NetFlow collectors.

End-to-end and summarized views

Cisco MNFC provides graphical historical and trending reports. Since Cisco MNFC imports the data from multiple Cisco NFC servers, it provides a centralized, end-to-end view. Traffic summarization is also performed.

Product Specifications

Table 2. Product Specifications

Product Name

OS Support

Hardware Recommendation

Cisco NetFlow Collector 6.0

Solaris versions 8, 9, and 10

RHEL version 2.1, 3.0, and 4.0 (ES and AS)

Cisco NetFlow Collector, version 6.0 has the following hardware requirements:

Minimum requirement:

• 2 GB RAM, 73 GB disk, dual processor on an entry-level server.
• Recommended: 4 to 8 GB RAM, two or more 15K SAS 146 GB or greater disks, dual 3 GHz dual-core (5160) processor entry-level server.

The following operating systems and platforms are supported:

• Solaris 8, 9, or 10 on an entry-level server with dual 1 GHz or greater SPARC processors, such as a Sun Fire V240.
• Red Hat Enterprise Linux 2.1, 3, or 4 on an entry-level server, such as an IBM x3550 or x3650 with dual 2.8 GHz or greater Intel Xeon single-core processor or dual 3 GHz dual-core (5160) processors.

Note that the CPU, RAM, and disk space recommendations above are suggested, and that actual requirements are determined by your configuration and by the volume and uniqueness of NetFlow data that is received. Actual resource usage can vary greatly depending on these factors.

Cisco Multi-NFC 6.0

Solaris versions 8, 9, and 10

RHEL version 2.1, 3.0, and 4.0 (ES and AS)

Cisco Multi-NFC, version 6.0 has the following hardware requirements:

IBM346: IBM x346: Single dual-core Intel Xeon 3.8 GHz CPU, 16 GB Memory, 280 GB Ultra320 SCSI hard disk. OS-RHEL AS 464-bit.
SolarisV490: Sun Fire V490: Quad UltraSPARC-IV+1.5 GHz CPUs, 16 GB Memory, 292 GB FC-AL Hard disk. OS - Solaris 10.


Cisco documentation is available in the following ways:

• For information about Cisco NFC 6.0 and Cisco MNFC 6.0 performance, sizing, and deployment plan, visit:

• Registered Cisco Direct customers can order Cisco product documentation from the Networking Products Marketplace at

• Registered users can order the documentation CD-ROM through the online Subscription Store at

• Nonregistered users can order documentation through a local account representative by calling Cisco corporate headquarters (California, USA) at (408) 526-7208 or, elsewhere in North America, by calling (800) 553-NETS (6387).

Ordering Information

Table 3 contains ordering information. To place an order, refer to the Cisco NFC 6.0 ordering guide at

Table 3. Ordering Information

Product Name

Part Number

Cisco NetFlow Collector (NFC) 6.0 - Tier one (RHEL 3.0 and 4.0; Solaris 9 and 10)


Cisco Multi-NFC (MNFC) 6.0 - Tier two (RHEL 3.0 and 4.0; Solaris 9 and 10)


Service and Support

Using the Cisco Lifecycle Services approach, Cisco and its partners provide a broad portfolio of end-to-end services and support that can help increase your network's business value and return on investment. This approach defines the minimum set of activities needed, by technology and by network complexity, to help you successfully deploy and operate Cisco technologies and optimize their performance throughout the lifecycle of your network.

For More Information

For more information about Cisco NetFlow Collector, visit, contact your local account representative, or send an e-mail to the customer support group at