Flexible NetFlow Command Reference, Cisco IOS XE Release 3SE (Cisco WLC 5700 Series)
Flexible NetFlow Commands
Downloads: This chapterpdf (PDF - 1.89MB) The complete bookPDF (PDF - 2.81MB) | The complete bookePub (ePub - 256.0KB) | Feedback

Flexible NetFlow Commands

Contents

Flexible NetFlow Commands

cache

To configure a flow cache parameter for a flow monitor, use the cache command in flow monitor configuration mode. To remove a flow cache parameter for a flow monitor, use the no form of this command.

cache { timeout { active | inactive } seconds | type normal }

no cache { timeout { active | inactive } | type }

Syntax Description

timeout

Specifies the flow timeout.

active

Specifies the active flow timeout.

inactive

Specifies the inactive flow timeout.

seconds

The timeout value in seconds. The range is 1 to 604800 (7 days).

type

Specifies the type of the flow cache.

normal

Configures a normal cache type. The entries in the flow cache will be aged out according to the timeout active seconds and timeout inactive seconds settings. This is the default cache type.

Command Default

The default flow monitor flow cache parameters are used.

The following flow cache parameters for a flow monitor are enabled:

  • Cache type: normal
  • Active flow timeout: 1800 seconds

Command Modes

Flow monitor configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

Each flow monitor has a cache that it uses to store all the flows it monitors. Each cache has various configurable elements, such as the time that a flow is allowed to remain in it. When a flow times out, it is removed from the cache and sent to any exporters that are configured for the corresponding flow monitor.

The cache timeout active command controls the aging behavior of the normal type of cache. If a flow has been active for a long time, it is usually desirable to age it out (starting a new flow for any subsequent packets in the flow). This age out process allows the monitoring application that is receiving the exports to remain up to date. By default, this timeout is 1800 seconds (30 minutes), but it can be adjusted according to system requirements. A larger value ensures that long-lived flows are accounted for in a single flow record; a smaller value results in a shorter delay between starting a new long-lived flow and exporting some data for it. When you change the active flow timeout, the new timeout value takes effect immediately.

The cache timeout inactive command also controls the aging behavior of the normal type of cache. If a flow has not seen any activity for a specified amount of time, that flow will be aged out. By default, this timeout is 15 seconds, but this value can be adjusted depending on the type of traffic expected. If a large number of short-lived flows is consuming many cache entries, reducing the inactive timeout can reduce this overhead. If a large number of flows frequently get aged out before they have finished collecting their data, increasing this timeout can result in better flow correlation. When you change the inactive flow timeout, the new timeout value takes effect immediately.

The cache type normal command specifies the normal cache type. This is the default cache type. The entries in the cache will be aged out according to the timeout active seconds and timeout inactive seconds settings. When a cache entry is aged out, it is removed from the cache and exported via any exporters configured for the monitor associated with the cache.

To return a cache to its default settings, use the default cache flow monitor configuration command.


Note


When a cache becomes full, new flows will not be monitored. If this occurs, a Flows not added statistic will appear in the cache statistics.


Examples

The following example shows how to configure the active timeout for the flow monitor cache:

Controller(config)# flow monitor FLOW-MONITOR-1 Controller(config-flow-monitor)# cache timeout active 4800

The following example shows how to configure the inactive timer for the flow monitor cache:

Controller(config)# flow monitor FLOW-MONITOR-1 Controller(config-flow-monitor)# cache timeout inactive 30

The following example shows how to configure a normal cache:

Controller(config)# flow monitor FLOW-MONITOR-1 Controller(config-flow-monitor)# cache type normal

Related Commands

Command

Description

flow monitor

Creates a flow monitor, or modifies an existing flow monitor, and enters flow monitor configuration mode.

clear flow exporter

To clear the statistics for a Flexible NetFlow flow exporter, use the clear flow exporter command in privileged EXEC mode.

clear flow exporter [ [ name ] exporter-name ] statistics

Syntax Description

name

(Optional) Specifies the name of a flow exporter.

exporter-name

(Optional) Name of a flow exporter that was previously configured.

statistics

Clears the flow exporter statistics.

Command Modes

Privileged EXEC

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

The clear flow exporter command removes all statistics from the flow exporter. These statistics will not be exported and the data gathered in the cache will be lost.

You can view the flow exporter statistics by using the show flow exporter statistics privileged EXEC command.

Examples

The following example clears the statistics for all of the flow exporters configured on the controller:

Controller# clear flow exporter statistics

The following example clears the statistics for the flow exporter named FLOW-EXPORTER-1:

Controller# clear flow exporter FLOW-EXPORTER-1 statistics

Related Commands

Command

Description

debug flow exporter

Enables debugging output for Flexible NetFlow flow exporters.

show flow exporter

Displays flow exporter status and statistics.

clear flow monitor

To clear a flow monitor cache or flow monitor statistics and to force the export of the data in the flow monitor cache, use the clear flow monitor command in privileged EXEC mode.

clear flow monitor [ name ] monitor-name [ [ cache ] force-export | statistics ]

Syntax Description

name

Specifies the name of a flow monitor.

monitor-name

Name of a flow monitor that was previously configured.

cache

(Optional) Clears the flow monitor cache information.

force-export

(Optional) Forces the export of the flow monitor cache statistics.

statistics

(Optional) Clears the flow monitor statistics.

Command Modes

Privileged EXEC

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

The clear flow monitor cache command removes all entries from the flow monitor cache. These entries will not be exported and the data gathered in the cache will be lost.

Note


The statistics for the cleared cache entries are maintained.


The clear flow monitor force-export command removes all entries from the flow monitor cache and exports them using all flow exporters assigned to the flow monitor. This action can result in a short-term increase in CPU usage. Use this command with caution.

The clear flow monitor statistics command clears the statistics for this flow monitor.


Note


The current entries statistic will not be cleared by the clear flow monitor statistics command because this is an indicator of how many entries are in the cache and the cache is not cleared with this command.

You can view the flow monitor statistics by using the show flow monitor statistics privileged EXEC command.

Examples

The following example clears the statistics and cache entries for the flow monitor named FLOW-MONITOR-1:

Controller# clear flow monitor name FLOW-MONITOR-1 

The following example clears the statistics and cache entries for the flow monitor named FLOW-MONITOR-1 and forces an export:

Controller# clear flow monitor name FLOW-MONITOR-1 force-export

The following example clears the cache for the flow monitor named FLOW-MONITOR-1 and forces an export:

Controller# clear flow monitor name FLOW-MONITOR-1 cache force-export

The following example clears the statistics for the flow monitor named FLOW-MONITOR-1:

Controller# clear flow monitor name FLOW-MONITOR-1 statistics

Related Commands

Command

Description

debug flow monitor

Enables debugging output for Flexible NetFlow flow monitors.

show flow monitor

Displays the status and statistics for a Flexible NetFlow flow monitor.

collect

To configure non-key fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record, use the collect command in flow record configuration mode.

collect { counter | interface | timestamp | transport | wireless }

Syntax Description

counter

Configures the number of bytes or packets in a flow as a non-key field for a flow record. For more information, see collect counter.

interface

Configures the input and output interface name as a non-key field for a flow record. For more information, see collect interface.

timestamp

Configures the absolute time of the first seen or last seen packet in a flow as a non-key field for a flow record. For more information, see collect timestamp absolute.

transport

Enables the collecting of transport TCP flags from a flow record. For more information, see collect transport tcp flags.

wireless

Enables the collection of access point MAC addresses. For more information, see collect wireless ap mac address (wireless).

Command Default

Non-key fields are not configured for the flow monitor record.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

The values in non-key fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a non-key field does not create a new flow. In most cases, the values for non-key fields are taken from only the first packet in the flow.

The collect commands are used to configure non-key fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in non-key fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a non-key field does not create a new flow. In most cases the values for non-key fields are taken from only the first packet in the flow.


Note


Although it is visible in the command-line help string, the flow username keyword is not supported.

Examples

The following example configures the total number of bytes in the flows as a non-key field:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# collect counter bytes long


Related Commands

Command

Description

collect counter

Configures the number of bytes or packets in a flow as a non-key field for a flow record.

collect interface

Configures the input interface as a non-key field for a flow record.

collect timestamp absolute

Configures the absolute time of the first seen or last seen packet in a flow as a non-key field for a flow record.

collect transport tcp flags

Configures one or more of the TCP fields as a non-key field for a flow record and enables collecting the values from the flow.

collect wireless ap mac address (wireless)

Collects the MAC addresses of the access points that the wireless client is associated with.

collect counter

To configure the number of bytes or packets in a flow as a non-key field for a flow record, use the collect counter command in flow record configuration mode. To disable the use of the number of bytes or packets in a flow (counters) as a non-key field for a flow record, use the no form of this command.

collect counter { bytes layer2 long | bytes long | packets long }

no collect counter { bytes layer2 long | bytes long | packets long }

Syntax Description

bytes layer2 long

Configures the number of Layer 2 bytes seen in a flow as a non-key field, and enables collecting the total number of Layer 2 bytes from the flow using a 64-bit counter.

bytes long

Configures the number of bytes seen in a flow as a non-key field, and enables collecting the total number of bytes from the flow using a 64-bit counter.

packets long

Configures the number of packets seen in a flow as a non-key field and enables collecting the total number of packets from the flow using a 64-bit counter.

Command Default

The number of bytes or packets in a flow is not configured as a non-key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

The collect counter bytes long command configures a 64-bit counter for the number of bytes seen in a flow.

The collect counter packets long command configures a 64-bit counter that will be incremented for each packet seen in the flow. It is unlikely that a 64-bit counter will ever restart at 0.

To return this command to its default settings, use the no collect counter or default collect counter flow record configuration command.

Examples

The following example configures the total number of bytes in the flows as a non-key field:

Controller(config)# flow record FLOW-RECORD-1 Controller(config-flow-record)#collect counter bytes long

The following example configures the total number of packets from the flows as a non-key field:

Controller(config)# flow record FLOW-RECORD-1 Controller(config-flow-record)# collect counter packets long

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

collect interface

To configure the input interface name as a non-key field for a flow record, use the collect interface command in flow record configuration mode. To disable the use of the input interface as a non-key field for a flow record, use the no form of this command.

collect interface input

no collect interface input

Syntax Description

input

Configures the input interface name as a non-key field and enables collecting the input interface from the flows.

Command Default

The input interface name is not configured as a non-key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

The Flexible NetFlow collect commands are used to configure non-key fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in non-key fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a non-key field does not create a new flow. In most cases, the values for non-key fields are taken from only the first packet in the flow.

To return this command to its default settings, use the no collect interface or default collect interface flow record configuration command.

Examples

The following example configures the input interface as a non-key field:

Controller(config)# flow record FLOW-RECORD-1 Controller(config-flow-record)# collect interface input

Related Commands

Command

Description

flow exporter

Creates a Flexible NetFlow flow exporter, or modifies an existing Flexible NetFlow flow exporter, and enters Flexible NetFlow flow exporter configuration mode.

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

collect timestamp absolute

To configure the absolute time of the first seen or last seen packet in a flow as a non-key field for a flow record, use the collect timestamp absolute command in flow record configuration mode. To disable the use of the first seen or last seen packet in a flow as a non-key field for a flow record, use the no form of this command.

collect timestamp absolute { first | last }

no collect timestamp absolute { first | last }

Syntax Description

first

Configures the absolute time of the first seen packet in a flow as a non-key field and enables collecting time stamps from the flows.

last

Configures the absolute time of the last seen packet in a flow as a non-key field and enables collecting time stamps from the flows.

Command Default

The absolute time field is not configured as a non-key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

The collect commands are used to configure non-key fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in non-key fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a non-key field does not create a new flow. In most cases the values for non-key fields are taken from only the first packet in the flow.

Examples

The following example configures time stamps based on the absolute time of the first seen packet in a flow as a non-key field:

Controller(config)# flow record FLOW-RECORD-1 Controller(config-flow-record)# collect timestamp absolute first

The following example configures time stamps based on the absolute time of the last seen packet in a flow as a non-key field:

Controller(config)# flow record FLOW-RECORD-1 Controller(config-flow-record)# collect timestamp absolute last

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

collect transport tcp flags

To configure one or more TCP flags as a non-key field for a flow record and enable the collecting of values from the flow, use the collect transport tcp flags command in flow record configuration mode. To disable the use of one or more of the TCP fields as a non-key field for a flow record and disable collecting the values from the flow, use the no form of this command.

collect transport tcp flags [ ack | cwr | ece | fin | psh | rst | syn | urg ]

no collect transport tcp flags [ ack | cwr | ece | fin | psh | rst | syn | urg ]

Syntax Description

ack

(Optional) Configures the TCP acknowledgment flag as a non-key field.

cwr

(Optional) Configures the TCP congestion window reduced flag as a non-key field.

ece

(Optional) Configures the TCP Explicit Congestion Notification echo (ECE) flag as a non-key field.

fin

(Optional) Configures the TCP finish flag as a non-key field.

psh

(Optional) Configures the TCP push flag as a non-key field.

rst

(Optional) Configures the TCP reset flag as a non-key field.

syn

(Optional) Configures the TCP synchronize flag as a non-key field.

urg

(Optional) Configures the TCP urgent flag as a non-key field.

Command Default

The transport layer fields are not configured as a non-key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

The values of the transport layer fields are taken from all packets in the flow. You cannot specify which TCP flag to collect. You can only specify to collect transport TCP flags. All TCP flags will be collected with this command. The following transport TCP flags are collected:

  • ack—TCP acknowledgement flag
  • cwr—TCP congestion window reduced flag
  • ece—TCP ECN echo flag
  • fin—TCP finish flag
  • psh—TCP push flag
  • rst—TCP reset flag
  • syn—TCP synchronize flag
  • urg—TCP urgent flag

To return this command to its default settings, use the no collect collect transport tcp flags or default collect collect transport tcp flags flow record configuration command.

Examples

The following example configures the TCP acknowledgment flag as a non-key field:

Controller(config)# flow record FLOW-RECORD-1 Controller(config-flow-record)# collect transport tcp flags ack

The following example configures the TCP finish flag as a non-key field:

Controller(config)# flow record FLOW-RECORD-1 Controller(config-flow-record)# collect transport tcp flags fin

The following example configures the TCP reset flag as a non-key field:

Controller(config)# flow record FLOW-RECORD-1 Controller(config-flow-record)# collect transport tcp flags rst

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

collect wireless ap mac address (wireless)

To enable the collection of MAC addresses of the access points that the wireless client is associated with, use the collect wireless ap mac address command in the flow record configuration mode. To disable the collection of access point MAC addresses, use the no form of this command.

collect wireless ap mac address

no collect wireless ap mac address

Syntax Description

This command has no arguments or keywords.

Command Default

The collection of access point MAC addresses is not enabled by default.

Command Modes

Flow record configuration

Command History

Release

Modification

Cisco IOS XE 3.3SE

This command was introduced.

Usage Guidelines

The Flexible NetFlow collect commands are used to configure non-key fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in non-key fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a non-key field does not create a new flow. In most cases, the values for non-key fields are taken from only the first packet in the flow.

Examples

The following example configures the flow record to enable the collection of MAC addresses of the access points that the wireless client is associated with:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# collect wireless ap mac address

Related Commands

Command

Description

collect

Configures non-key fields for the flow monitor record and enables capturing the values in the fields for the flow created with the record.

collect wireless client mac address (wireless)

To enable the collection of MAC addresses of the wireless clients that the access point is associated with, use the collect wireless client mac address command in the flow record configuration mode. To disable the collection of access point MAC addresses, use the no form of this command.

collect wireless client mac address

no collect wireless client mac address

Syntax Description

This command has no arguments or keywords.

Command Default

The collection of wireless client MAC addresses is not enabled by default.

Command Modes

Flow record configuration

Command History

Release

Modification

Cisco IOS XE 3.3SE

This command was introduced.

Usage Guidelines

The Flexible NetFlow collect commands are used to configure non-key fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in non-key fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a non-key field does not create a new flow. In most cases, the values for non-key fields are taken from only the first packet in the flow.

Examples

The following example configures the flow record to enable the collection of MAC addresses of the access points that the wireless client is associated with:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# collect wireless client mac address

datalink flow monitor

To apply a Flexible NetFlow flow monitor to an interface, use the datalink flow monitor command in interface configuration mode. To disable a Flexible NetFlow flow monitor, use the no form of this command.

datalink flow monitor monitor-name sampler sampler-name input

no datalink flow monitor monitor-name sampler sampler-name input

Syntax Description

monitor-name

Name of the flow monitor to apply to the interface.

sampler sampler-name

Enables the specified flow sampler for the flow monitor.

input

Monitors traffic that the switch receives on the interface.

Command Default

A flow monitor is not enabled.

Command Modes

Interface configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

Before you apply a flow monitor to an interface with the datalink flow monitor command, you must have already created the flow monitor using the flow monitor global configuration command and the flow sampler using the sampler global configuration command.

To enable a flow sampler for the flow monitor, you must have already created the sampler.


Note


The datalink flow monitor command only monitors non-IPv4 and non-IPv6 traffic. To monitor IPv4 traffic, use the ip flow monitor command. To monitor IPv6 traffic, use the ipv6 flow monitor command.

Examples

This example shows how to enable Flexible NetFlow datalink monitoring on an interface:

Controller(config)# interface gigabitethernet1/0/1
Controller(config-if)# datalink flow monitor FLOW-MONITOR-1 sampler FLOW-SAMPLER-1 input

Related Commands

Command

Description

flow monitor

Creates a flow monitor, or modifies an existing flow monitor, and enters flow monitor configuration mode.

datalink flow monitor (wireless)

To enable NetFlow monitoring in a WLAN, use the datalink flow monitor command in WLAN configuration mode. To disable NetFlow monitoring, use the no form of this command.

datalink flow monitor datalink-monitor-name { input | output }

no datalink flow monitor datalink-monitor-name { input | output }

Syntax Description

datalink-monitor-name

Flow monitor name. The name is case sensitive and consists of alphanumeric characters, with a maximum of 31 characters.

input

Specifies the NetFlow monitor for ingress traffic.

output

Specifies the NetFlow monitor for egress traffic.

Command Default

Flow monitor is not configured by default for WLAN interface.

Command Modes

WLAN configuration

Command History

Release

Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

Before you apply a flow monitor to an interface with the datalink flow monitor command, you must have already created the flow monitor using the flow monitor global configuration command.

Examples

This example shows how to enable NetFlow monitoring on a WLAN:

Controller(config)# wlan wlan1
Controller(config-wlan)# datalink flow monitor test output                            

This example shows how to disable NetFlow monitor on a WLAN:

Controller(config)# wlan wlan1
Controller(config-wlan)# no datalink flow monitor test output

Related Commands

Command

Description

flow monitor

Creates a flow monitor, or modifies an existing flow monitor, and enters flow monitor configuration mode.

debug flow exporter

To enable debugging output for Flexible NetFlow flow exporters, use the debug flow exporter command in privileged EXEC mode. To disable debugging output, use the no form of this command.

debug flow exporter [ [ name ] exporter-name ] [ error | event | packets number ]

no debug flow exporter [ [ name ] exporter-name ] [ error | event | packets number ]

Syntax Description

name

(Optional) Specifies the name of a flow exporter.

exporter-name

(Optional) The name of a flow exporter that was previously configured.

error

(Optional) Enables debugging for flow exporter errors.

event

(Optional) Enables debugging for flow exporter events.

packets

(Optional) Enables packet-level debugging for flow exporters.

number

(Optional) The number of packets to debug for packet-level debugging of flow exporters. The range is 1 to 65535.

Command Modes

Privileged EXEC

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Examples

The following example indicates that a flow exporter packet has been queued for process send:

Controller# debug flow exporter
May 21 21:29:12.603: FLOW EXP: Packet queued for process send

Related Commands

Command

Description

clear flow exporter

Clears the statistics for a Flexible NetFlow flow exporter.

debug flow monitor

To enable debugging output for Flexible NetFlow flow monitors, use the debug flow monitor command in privileged EXEC mode. To disable debugging output, use the no form of this command.

debug flow monitor [ error | [ name ] monitor-name [ cache [ error ] | error | packets packets ] ]

no debug flow monitor [ error | [ name ] monitor-name [ cache [ error ] | error | packets packets ] ]

Syntax Description

error

(Optional) Enables debugging for flow monitor errors for all flow monitors or for the specified flow monitor.

name

(Optional) Specifies the name of a flow monitor.

monitor-name

(Optional) Name of a flow monitor that was previously configured.

cache

(Optional) Enables debugging for the flow monitor cache.

cache error

(Optional) Enables debugging for flow monitor cache errors.

packets

(Optional) Enables packet-level debugging for flow monitors.

packets

(Optional) Number of packets to debug for packet-level debugging of flow monitors. The range is 1 to 65535.

Command Modes

Privileged EXEC

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Examples

The following example shows that the cache for FLOW-MONITOR-1 was deleted:

Controller# debug flow monitor FLOW-MONITOR-1 cache
May 21 21:53:02.839: FLOW MON:  'FLOW-MONITOR-1' deleted cache

Related Commands

Command

Description

clear flow monitor

Clears a flow monitor cache or flow monitor statistics and forces the export of the data in the flow monitor cache.

debug flow record

To enable debugging output for Flexible NetFlow flow records, use the debug flow record command in privileged EXEC mode. To disable debugging output, use the no form of this command.

debug flow record [ [ name ] record-name | options { sampler-table } | [ detailed | error ] ]

no debug flow record [ [ name ] record-name | options { sampler-table } | [ detailed | error ] ]

Syntax Description

name

(Optional) Specifies the name of a flow record.

record-name

(Optional) Name of a user-defined flow record that was previously configured.

options

(Optional) Includes information on other flow record options.

sampler-table

(Optional) Includes information on the sampler tables.

detailed

(Optional) Displays detailed information.

error

(Optional) Displays errors only.

Command Modes

Privileged EXEC

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Examples

The following example enables debugging for the flow record:

Controller# debug flow record FLOW-record-1

debug sampler

To enable debugging output for Flexible NetFlow samplers, use the debug sampler command in privileged EXEC mode. To disable debugging output, use the no form of this command.

debug sampler [ detailed | error | [ name ] sampler-name [ detailed | error | sampling samples ] ]

no debug sampler [ detailed | error | [ name ] sampler-name [ detailed | error | sampling ] ]

Syntax Description

detailed

(Optional) Enables detailed debugging for sampler elements.

error

(Optional) Enables debugging for sampler errors.

name

(Optional) Specifies the name of a sampler.

sampler-name

(Optional) Name of a sampler that was previously configured.

sampling samples

(Optional) Enables debugging for sampling and specifies the number of samples to debug.

Command Modes

Privileged EXEC

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Examples

The following sample output shows that the debug process has obtained the ID for the sampler named SAMPLER-1:

Controller# debug sampler detailed
*May 28 04:14:30.883: Sampler: Sampler(SAMPLER-1: flow monitor FLOW-MONITOR-1 (ip,Et1/0,O) get ID succeeded:1
*May 28 04:14:30.971: Sampler: Sampler(SAMPLER-1: flow monitor FLOW-MONITOR-1 (ip,Et0/0,I) get ID succeeded:1

description

To configure a description for a flow monitor, flow exporter, or flow record, use the description command in the appropriate configuration mode. To remove a description, use the no form of this command.

description description

no description description

Syntax Description

description

Text string that describes the flow monitor, flow exporter, or flow record.

Command Default

The default description for a flow sampler, flow monitor, flow exporter, or flow record is "User defined."

Command Modes

The following command modes are supported:

Flow exporter configuration

Flow monitor configuration

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

To return this command to its default setting, use the no description or default description command in the appropriate configuration mode.

Examples

The following example configures a description for a flow monitor:

Controller(config)# flow monitor FLOW-MONITOR-1
Controller(config-flow-monitor)# description Monitors traffic to 172.16.0.1 255.255.0.0

Related Commands

Command

Description

flow exporter

Creates a Flexible NetFlow flow exporter, or modifies an existing Flexible NetFlow flow exporter, and enters Flexible NetFlow flow exporter configuration mode.

flow monitor

Creates a flow monitor, or modifies an existing flow monitor, and enters flow monitor configuration mode.

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

destination

To configure an export destination for a flow exporter, use the destination command in flow exporter configuration mode. To remove an export destination for a flow exporter, use the no form of this command.

destination { hostname | ip-address } vrf vrf-label

no destination { hostname | ip-address } vrf vrf-label

Syntax Description

hostname

Hostname of the device to which you want to send the NetFlow information.

ip-address

IPv4 address of the workstation to which you want to send the NetFlow information.

vrf

(Optional) Specifies that the export data packets are to be sent to the named Virtual Private Network (VPN) routing and forwarding (VRF) instance for routing to the destination, instead of to the global routing table.

vrf-label

Name of the VRF instance.

Command Default

An export destination is not configured.

Command Modes

Flow exporter configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

Each flow exporter can have only one destination address or hostname.

When you configure a hostname instead of the IP address for the device, the hostname is resolved immediately and the IPv4 address is stored in the running configuration. If the hostname-to-IP-address mapping that was used for the original Domain Name System (DNS) name resolution changes dynamically on the DNS server, the controller does not detect this, and the exported data continues to be sent to the original IP address, resulting in a loss of data.

To return this command to its default setting, use the no destination or default destination command in flow exporter configuration mode.

Examples

The following example shows how to configure the networking device to export the Flexible NetFlow cache entry to a destination system:

Controller(config)# flow exporter FLOW-EXPORTER-1 Controller(config-flow-exporter)# destination 10.0.0.4

The following example shows how to configure the networking device to export the Flexible NetFlow cache entry to a destination system using a VRF named VRF-1:

Controller(config)# flow exporter FLOW-EXPORTER-1 Controller(config-flow-exporter)# destination 172.16.0.2 vrf VRF-1


Related Commands

Command

Description

flow exporter

Creates a Flexible NetFlow flow exporter, or modifies an existing Flexible NetFlow flow exporter, and enters Flexible NetFlow flow exporter configuration mode.

dscp

To configure a differentiated services code point (DSCP) value for flow exporter datagrams, use the dscp command in flow exporter configuration mode. To remove a DSCP value for flow exporter datagrams, use the no form of this command.

dscp dscp

no dscp dscp

Syntax Description

dscp

DSCP to be used in the DSCP field in exported datagrams. The range is 0 to 63. The default is 0.

Command Default

The differentiated services code point (DSCP) value is 0.

Command Modes

Flow exporter configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

To return this command to its default setting, use the no dscp or default dscp flow exporter configuration command.

Examples

The following example sets 22 as the value of the DSCP field in exported datagrams:

Controller(config)# flow exporter FLOW-EXPORTER-1
Controller(config-flow-exporter)# dscp 22

Related Commands

Command

Description

flow exporter

Creates a Flexible NetFlow flow exporter, or modifies an existing Flexible NetFlow flow exporter, and enters Flexible NetFlow flow exporter configuration mode.

export-protocol netflow-v9

To configure NetFlow Version 9 export as the export protocol for a Flexible NetFlow exporter, use the export-protocol netflow-v9 command in flow exporter configuration mode.

export-protocol netflow-v9

Syntax Description

This command has no arguments or keywords.

Command Default

NetFlow Version 9 is enabled.

Command Modes

Flow exporter configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

The controller does not support NetFlow v5 export format, only NetFlow v9 export format is supported.

Examples

The following example configures NetFlow Version 9 export as the export protocol for a NetFlow exporter:

Controller(config)# flow exporter FLOW-EXPORTER-1
Controller(config-flow-exporter)# export-protocol netflow-v9

Related Commands

Command

Description

flow exporter

Creates a Flexible NetFlow flow exporter, or modifies an existing Flexible NetFlow flow exporter, and enters Flexible NetFlow flow exporter configuration mode.

exporter

To add a flow exporter for a flow monitor, use the exporter command in the appropriate configuration mode. To remove a flow exporter for a flow monitor, use the no form of this command.

exporter exporter-name

no exporter exporter-name

Syntax Description

exporter-name

Name of a flow exporter that was previously configured.

Command Default

An exporter is not configured.

Command Modes

Flow monitor configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

You must have already created a flow exporter by using the flow exporter command before you can apply the flow exporter to a flow monitor with the exporter command.

To return this command to its default settings, use the no exporter or default exporter flow monitor configuration command.

Examples

The following example configures an exporter for a flow monitor:

Controller(config)# flow monitor FLOW-MONITOR-1
Controller(config-flow-monitor)# exporter EXPORTER-1

Related Commands

Command

Description

flow exporter

Creates a Flexible NetFlow flow exporter, or modifies an existing Flexible NetFlow flow exporter, and enters Flexible NetFlow flow exporter configuration mode.

flow monitor

Creates a flow monitor, or modifies an existing flow monitor, and enters flow monitor configuration mode.

flow exporter

To create a Flexible NetFlow flow exporter, or to modify an existing Flexible NetFlow flow exporter, and enter Flexible NetFlow flow exporter configuration mode, use the flow exporter command in global configuration mode. To remove a Flexible NetFlow flow exporter, use the no form of this command.

flow exporter exporter-name

no flow exporter exporter-name

Syntax Description

exporter-name

Name of the flow exporter that is being created or modified.

Command Default

Flexible NetFlow flow exporters are not present in the configuration.

Command Modes

Global configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

Flow exporters export the data in the flow monitor cache to a remote system, such as a server running NetFlow collector, for analysis and storage. Flow exporters are created as separate entities in the configuration. Flow exporters are assigned to flow monitors to provide data export capability for the flow monitors. You can create several flow exporters and assign them to one or more flow monitors to provide several export destinations. You can create one flow exporter and apply it to several flow monitors.

Examples

The following example creates a flow exporter named FLOW-EXPORTER-1 and enters Flexible NetFlow flow exporter configuration mode:

Controller(config)# flow exporter FLOW-EXPORTER-1
Controller(config-flow-exporter)#

Related Commands

Command

Description

clear flow exporter

Clears the statistics for a Flexible NetFlow flow exporter.

debug flow exporter

Enables debugging output for Flexible NetFlow flow exporters.

show flow exporter

Displays flow exporter status and statistics.

flow monitor

To create a flow monitor, or to modify an existing flow monitor, and enter flow monitor configuration mode, use the flow monitor command in global configuration mode. To remove a flow monitor, use the no form of this command.

flow monitor monitor-name

no flow monitor monitor-name

Syntax Description

monitor-name

Name of the flow monitor that is being created or modified.

Command Default

Flexible NetFlow flow monitors are not present in the configuration.

Command Modes

Global configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

Flow monitors are the Flexible NetFlow component that is applied to interfaces to perform network traffic monitoring. Flow monitors consist of a flow record and a cache. You add the record to the flow monitor after you create the flow monitor. The flow monitor cache is automatically created at the time the flow monitor is applied to the first interface. Flow data is collected from the network traffic during the monitoring process based on the key and nonkey fields in the flow monitor's record and stored in the flow monitor cache.

Examples

The following example creates a flow monitor named FLOW-MONITOR-1 and enters flow monitor configuration mode:

Controller(config)# flow monitor FLOW-MONITOR-1
Controller(config-flow-monitor)#

Related Commands

Command

Description

clear flow monitor

Clears a flow monitor cache or flow monitor statistics and forces the export of the data in the flow monitor cache.

debug flow monitor

Enables debugging output for Flexible NetFlow flow monitors.

show flow monitor

Displays the status and statistics for a Flexible NetFlow flow monitor.

flow record

To create a Flexible NetFlow flow record, or to modify an existing Flexible NetFlow flow record, and enter Flexible NetFlow flow record configuration mode, use the flow record command in global configuration mode. To remove a Flexible NetFlow record, use the no form of this command.

flow record record-name

no flow record record-name

Syntax Description

record-name

Name of the flow record that is being created or modified.

Command Default

A Flexible NetFlow flow record is not configured.

Command Modes

Global configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record defines the keys that Flexible NetFlow uses to identify packets in the flow, as well as other fields of interest that Flexible NetFlow gathers for the flow. You can define a flow record with any combination of keys and fields of interest. The controller supports a rich set of keys. A flow record also defines the types of counters gathered per flow. You can configure 64-bit packet or byte counters.

Examples

The following example creates a flow record named FLOW-RECORD-1, and enters Flexible NetFlow flow record configuration mode:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)#

Related Commands

Command

Description

show flow record

Displays the status and statistics for a Flexible NetFlow flow record.

ip flow monitor

To enable a Flexible NetFlow flow monitor for IPv4 traffic that the controller is receiving, use the ip flow monitor command in interface configuration mode. To disable a flow monitor, use the no form of this command.

ip flow monitor monitor-name [ sampler sampler-name ] input

no ip flow monitor monitor-name [ sampler sampler-name ] input

Syntax Description

monitor-name

Name of the flow monitor to apply to the interface.

sampler sampler-name

(Optional) Enables the specified flow sampler for the flow monitor.

input

Monitors IPv4 traffic that the controller receives on the interface.

Command Default

A flow monitor is not enabled.

Command Modes

Interface configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

Before you can apply a flow monitor to an interface with the ip flow monitor command, you must have already created the flow monitor using the flow monitor global configuration command.

When you add a sampler to a flow monitor, only packets that are selected by the named sampler will be entered into the cache to form flows. Each use of a sampler causes separate statistics to be stored for that usage.

You cannot add a sampler to a flow monitor after the flow monitor has been enabled on the interface. You must first remove the flow monitor from the interface and then enable the same flow monitor with a sampler.


Note


The statistics for each flow must be scaled to give the expected true usage. For example, with a 1 in 100 sampler it is expected that the packet and byte counters will have to be multiplied by 100.


Examples

The following example enables a flow monitor for monitoring input traffic:

Controller(config)# interface gigabitethernet1/0/1
Controller(config-if)# ip flow monitor FLOW-MONITOR-1 input

The following example enables a flow monitor for monitoring input traffic, with a sampler to limit the input packets that are sampled:

Controller(config)# interface gigabitethernet1/0/1
Controller(config-if)# ip flow monitor FLOW-MONITOR-1 sampler SAMPLER-1 input

The following example shows what happens when you try to add a sampler to a flow monitor that has already been enabled on an interface without a sampler:

Controller(config)# interface gigabitethernet1/0/1
Controller(config-if)# ip flow monitor FLOW-MONITOR-1 sampler SAMPLER-2 input
% Flow Monitor: Flow Monitor 'FLOW-MONITOR-1' is already on in full mode and cannot be enabled with a sampler.

The following example shows how to remove a flow monitor from an interface so that it can be enabled with the sampler:

Controller(config)# interface gigabitethernet1/0/1
Controller(config-if)# no ip flow monitor FLOW-MONITOR-1 input
Controller(config-if)# ip flow monitor FLOW-MONITOR-1 sampler SAMPLER-2 input

Related Commands

Command

Description

flow monitor

Creates a flow monitor, or modifies an existing flow monitor, and enters flow monitor configuration mode.

sampler

Creates a Flexible NetFlow flow sampler, or modifies an existing Flexible NetFlow flow sampler.

ipv6 flow monitor

To enable a flow monitor for IPv6 traffic that the controller is receiving, use the ipv6 flow monitor command in interface configuration mode. To disable a flow monitor, use the no form of this command.

ipv6 flow monitor monitor-name [ sampler sampler-name ] input

no ipv6 flow monitor monitor-name [ sampler sampler-name ] input

Syntax Description

monitor-name

Name of the flow monitor to apply to the interface.

sampler sampler-name

(Optional) Enables the specified flow sampler for the flow monitor.

input

Monitors IPv6 traffic that the controller receives on the interface.

Command Default

A flow monitor is not enabled.

Command Modes

Interface configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

Before you can apply a flow monitor to the interface with the ipv6 flow monitor command, you must have already created the flow monitor using the flow monitor global configuration command.

When you add a sampler to a flow monitor, only packets that are selected by the named sampler will be entered into the cache to form flows. Each use of a sampler causes separate statistics to be stored for that usage.

You cannot add a sampler to a flow monitor after the flow monitor has been enabled on the interface. You must first remove the flow monitor from the interface and then enable the same flow monitor with a sampler.


Note


The statistics for each flow must be scaled to give the expected true usage. For example, with a 1 in 100 sampler it is expected that the packet and byte counters will have to be multiplied by 100.


Examples

The following example enables a flow monitor for monitoring input traffic:

Controller(config)# interface gigabitethernet1/0/1
Controller(config-if)# ipv6 flow monitor FLOW-MONITOR-1 input

The following example enables a flow monitor for monitoring input traffic, with a sampler to limit the input packets that are sampled:

Controller(config)# interface gigabitethernet1/0/1
Controller(config-if)# ipv6 flow monitor FLOW-MONITOR-1 sampler SAMPLER-1 input

The following example shows what happens when you try to add a sampler to a flow monitor that has already been enabled on an interface without a sampler:

Controller(config)# interface gigabitethernet1/0/1
Controller(config-if)# ipv6 flow monitor FLOW-MONITOR-1 sampler SAMPLER-2 input
% Flow Monitor: Flow Monitor 'FLOW-MONITOR-1' is already on in full mode and cannot be enabled with a sampler.

The following example shows how to remove a flow monitor from an interface so that it can be enabled with the sampler:

Controller(config)# interface gigabitethernet1/0/1
Controller(config-if)# no ipv6 flow monitor FLOW-MONITOR-1 input
Controller(config-if)# ipv6 flow monitor FLOW-MONITOR-1 sampler SAMPLER-2 input

Related Commands

Command

Description

flow monitor

Creates a flow monitor, or modifies an existing flow monitor, and enters flow monitor configuration mode.

sampler

Creates a Flexible NetFlow flow sampler, or modifies an existing Flexible NetFlow flow sampler.

ip flow monitor (wireless)

To configure IPv4 NetFlow monitoring, use the ip flow monitor command in WLAN configuration mode. To remove IPv4 NetFlow monitoring, use the no form of this command.

ip flow monitor ip-monitor-name { input | output }

no ip flow monitor ip-monitor-name { input | output }

Syntax Description

ip-monitor-name

Flow monitor name.

input

Enables a flow monitor for IPv4 ingress traffic.

output

Enables a flow monitor for IPv4 egress traffic.

Command Default

A flow monitor is not enabled.

Command Modes

WLAN configuration

Usage Guidelines

Before you can apply a IPv4 flow monitor to an interface with the ip flow monitor command, you need to create the flow monitor using the flow monitor global configuration command.

Command History

Release

Modification

Cisco IOS XE 3.2SE

This command was introduced.

Examples

This example shows how to configure an IP flow monitor for ingress traffic:

Controller(config)# wlan wlan1
Controller(config-wlan)# ip flow monitor test input

This example shows how to disable an IP flow monitor:

Controller(config)# wlan wlan1
Controller(config-wlan)# no ip flow monitor test input

ipv6 flow monitor (wireless)

To configure IPv6 NetFlow monitoring, use the ipv6 flow monitor command in wlan configuration mode. To remove IPv6 NetFlow monitoring, use the no form of this command.

ipv6 flow monitor ipv6-monitor-name { input | output }

no ipv6 flow monitor ipv6-monitor-name { input | output }

Syntax Description

ipv6-monitor-name

Flow monitor name.

input

Enables a flow monitor for IPv6 ingress traffic.

output

Enables a flow monitor for IPv6 egress traffic.

Command Default

A flow monitor is not enabled.

Command Modes

Wlan configuration

Usage Guidelines

Before you can apply an IPv6 flow monitor to an interface with the ipv6 flow monitor command, you need to create the flow monitor using the flow monitor global configuration command.

The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Command History

Release

Modification

Cisco IOS XE 3.2SE

This command was introduced.

Examples

This example shows how to configure an IPv6 flow monitor for ingress traffic:

Controller(config)# wlan wlan1
Controller(config-wlan)# ipv6 flow monitor test input

This example shows how to disable an IPv6 flow monitor:

Controller(config)# wlan wlan1
Controller(config-wlan)# no ipv6 flow monitor test input

match application name (wireless)

This command is specific to the Application Visibility and Control (AVC) feature. To specify a match to the application name, use the match application name in flow record configuration mode. To disable the use of the application name as a key field for a flow record, use the no form of this command.

match application name

no match application name

Syntax Description

This command has no arguments or keywords.

Command Default

The application name is not configured as a key field, by default.

Command Modes

Flow record configuration

Command History

Release

Modification

Cisco IOS XE 3.3SE

This command was introduced.

Usage Guidelines

This command is specific to the AVC feature. For more information, see the System Management Configuration Guide, Cisco IOS XE Release 3SE.

Examples

This command is specific to the AVC feature. For examples, see the System Management Configuration Guide, Cisco IOS XE Release 3SE.

match datalink dot1q priority

To configure the 802.1Q (dot1q) priority value as a key field for a flow record, use the match datalink dot1q priority command in flow record configuration mode. To disable the use of the priority as a key field for a flow record, use the no form of this command.

match datalink dot1q priority

no match datalink dot1q priority

Syntax Description

This command has no arguments or keywords.

Command Default

The priority field is not configured as a key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

The observation point of the match datalink dot1q priority command is the interface to which the flow monitor that contains the flow record with the command is applied.

Examples

The following example configures the 802.1Q priority as a key field for a flow record:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match datalink dot1q priority

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match datalink dot1q vlan

To configure the 802.1Q (dot1q) VLAN value as a key field for a flow record, use the match datalink dot1q vlan command in flow record configuration mode. To disable the use of the 802.1Q VLAN value as a key field for a flow record, use the no form of this command.

match datalink dot1q vlan { input | output }

no match datalink dot1q vlan { input | output }

Syntax Description

input

Configures the VLAN ID of traffic being received by the controller as a key field.

output

Configures the VLAN ID of traffic being transmitted by the controller as a key field.

Command Default

The 802.1Q VLAN ID is not configured as a key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

The input and output keywords of the match datalink dot1q vlan command are used to specify the observation point that is used by the match datalink dot1q vlan command to create flows based on the unique 802.1q VLAN IDs in the network traffic.

Examples

The following example configures the 802.1Q VLAN ID of traffic being received by the controller as a key field for a flow record:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match datalink dot1q vlan input

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match datalink ethertype

To configure the EtherType of the packet as a key field for a flow record, use the match datalink ethertype command in flow record configuration mode. To disable the EtherType of the packet as a key field for a flow record, use the no form of this command.

match datalink ethertype

no match datalink ethertype

Syntax Description

This command has no arguments or keywords.

Command Default

The EtherType of the packet is not configured as a key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

When you configure the EtherType of the packet as a key field for a flow record using the match datalink ethertype command, the traffic flow that is created is based on the type of flow monitor that is assigned to the interface:

  • When a datalink flow monitor is assigned to an interface using the datalink flow monitor interface configuration command, it creates unique flows for different Layer 2 protocols.
  • When an IP flow monitor is assigned to an interface using the ip flow monitor interface configuration command, it creates unique flows for different IPv4 protocols.
  • When an IPv6 flow monitor is assigned to an interface using the ipv6 flow monitor interface configuration command, it creates unique flows for different IPv6 protocols.

To return this command to its default settings, use the no match datalink ethertype or default match datalink ethertype flow record configuration command.

Examples

The following example configures the EtherType of the packet as a key field for a Flexible NetFlow flow record:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match datalink ethertype

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match datalink mac

To configure the use of MAC addresses as a key field for a flow record, use the match datalink mac command in flow record configuration mode. To disable the use of MAC addresses as a key field for a flow record, use the no form of this command.

match datalink mac { destination address input | source address input }

no match datalink mac { destination address input | source address input }

Syntax Description

destination address

Configures the use of the destination MAC address as a key field.

input

Specifies the MAC address of input packets.

source address

Configures the use of the source MAC address as a key field.

Command Default

MAC addresses are not configured as a key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

The input keyword is used to specify the observation point that is used by the match datalink mac command to create flows based on the unique MAC addresses in the network traffic.


Note


When a datalink flow monitor is assigned to an interface or VLAN record, it creates flows only for non-IPv6 or non-IPv4 traffic.

To return this command to its default settings, use the no match datalink mac or default match datalink mac flow record configuration command.

Examples

The following example configures the use of the destination MAC address of packets that are received by the controller as a key field for a flow record:

Controller(config)# flow record FLOW-RECORD-1 Controller(config-flow-record)# match datalink mac destination address input

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match datalink vlan

To configure the VLAN ID as a key field for a flow record, use the match datalink vlan command in flow record configuration mode. To disable the use of the VLAN ID value as a key field for a flow record, use the no form of this command.

match datalink vlan input

no match datalink vlan input

Syntax Description

input

Configures the VLAN ID of traffic being received by the controller as a key field.

Command Default

The VLAN ID is not configured as a key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

The input keyword is used to specify the observation point that is used by the match datalink vlan command to create flows based on the unique VLAN IDs in the network traffic.

Examples

The following example configures the VLAN ID of traffic being received by the controller as a key field for a flow record:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match datalink vlan input

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match flow direction

To configure the flow direction as key fields for a flow record, use the match flow direction command in flow record configuration mode. To disable the use of the flow direction as key fields for a flow record, use the no form of this command.

match flow direction

no match flow direction

Syntax Description

This command has no arguments or keywords.

Command Default

The flow direction is not configured as key fields.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

The match flow direction command captures the direction of the flow as a key field. This feature is most useful when a single flow monitor is configured for input and output flows. It can be used to find and eliminate flows that are being monitored twice, once on input and once on output. This command can help to match up pairs of flows in the exported data when the two flows are flowing in opposite directions.

Examples

The following example configures the direction the flow was monitored in as a key field:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match flow direction

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match interface

To configure the input and output interfaces as key fields for a flow record, use the match interface command in flow record configuration mode. To disable the use of the input and output interfaces as key fields for a flow record, use the no form of this command.

match interface { input | output }

no match interface { input | output }

Syntax Description

input

Configures the input interface as a key field.

output

Configures the output interface as a key field.

Command Default

The input and output interfaces are not configured as key fields.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

Examples

The following example configures the input interface as a key field:

Controller(config)# flow record FLOW-RECORD-1 Controller(config-flow-record)# match interface input

The following example configures the output interface as a key field:

Controller(config)# flow record FLOW-RECORD-1 Controller(config-flow-record)# match interface output

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match ipv4

To configure one or more of the IPv4 fields as a key field for a flow record, use the match ipv4 command in flow record configuration mode. To disable the use of one or more of the IPv4 fields as a key field for a flow record, use the no form of this command.

match ipv4 { destination address | protocol | source address | tos | ttl | version }

no match ipv4 { destination address | protocol | source address | tos | ttl | version }

Syntax Description

destination address

Configures the IPv4 destination address as a key field. For more information see match ipv4 destination address.

protocol

Configures the IPv4 protocol as a key field.

source address

Configures the IPv4 destination address as a key field. For more information see match ipv4 source address.

tos

Configures the IPv4 ToS as a key field.

ttl

Configures the IPv4 time-to-live (TTL) field as a key field for a flow record. For more information see match ipv4 ttl.

version

Configures the IP version from IPv4 header as a key field.

Command Default

The use of one or more of the IPv4 fields as a key field for a user-defined flow record is not enabled.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

Examples

The following example configures the IPv4 protocol as a key field:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match ipv4 protocol

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match ipv4 destination address

To configure the IPv4 destination address as a key field for a flow record, use the match ipv4 destination address command in flow record configuration mode. To disable the IPv4 destination address as a key field for a flow record, use the no form of this command.

match ipv4 destination address

no match ipv4 destination address

Syntax Description

This command has no arguments or keywords.

Command Default

The IPv4 destination address is not configured as a key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

To return this command to its default settings, use the no match ipv4 destination address or default match ipv4 destination address flow record configuration command.

Examples

The following example configures the IPv4 destination address as a key field for a flow record:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match ipv4 destination address

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match ipv4 source address

To configure the IPv4 source address as a key field for a flow record, use the match ipv4 source address command in flow record configuration mode. To disable the use of the IPv4 source address as a key field for a flow record, use the no form of this command.

match ipv4 source address

no match ipv4 source address

Syntax Description

This command has no arguments or keywords.

Command Default

The IPv4 source address is not configured as a key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

To return this command to its default settings, use the no match ipv4 source address or default match ipv4 source address flow record configuration command.

Examples

The following example configures the IPv4 source address as a key field:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match ipv4 source address

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match ipv4 ttl

To configure the IPv4 time-to-live (TTL) field as a key field for a flow record, use the match ipv4 ttl command in flow record configuration mode. To disable the use of the IPv4 TTL field as a key field for a flow record, use the no form of this command.

match ipv4 ttl

no match ipv4 ttl

Syntax Description

This command has no arguments or keywords.

Command Default

The IPv4 time-to-live (TTL) field is not configured as a key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match ipv4 ttl command.

Examples

The following example configures IPv4 TTL as a key field:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match ipv4 ttl

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match ipv6

To configure one or more of the IPv6 fields as a key field for a flow record, use the match ipv6 command in flow record configuration mode. To disable the use of one or more of the IPv6 fields as a key field for a flow record, use the no form of this command.

match ipv6 { destination address | hop-limit | protocol | source address }

no match ipv6 { destination address | hop-limit | flow-label | protocol | source address }

Syntax Description

destination address

Configures the IPv4 destination address as a key field. For more information see match ipv6 destination address.

hop-limit

Configures the IPv6 hop limit as a key field. For more information see match ipv6 hop-limit.

protocol

Configures the IPv6 protocol as a key field.

source address

Configures the IPv4 destination address as a key field. For more information see match ipv6 source address.

traffic-class

Configures the IPv6 traffic class as a key field.

version

Configures the IPv6 version from IPv6 header as a key field.

Command Default

The IPv6 fields are not configured as a key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

Examples

The following example configures the IPv6 protocol field as a key field:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match ipv6 protocol

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match ipv6 destination address

To configure the IPv6 destination address as a key field for a flow record, use the match ipv6 destination address command in flow record configuration mode. To disable the IPv6 destination address as a key field for a flow record, use the no form of this command.

match ipv6 destination address

no match ipv6 destination address

Syntax Description

This command has no arguments or keywords.

Command Default

The IPv6 destination address is not configured as a key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

To return this command to its default settings, use the no match ipv6 destination address or default match ipv6 destination address flow record configuration command.

Examples

The following example configures the IPv6 destination address as a key field:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match ipv6 destination address

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match ipv6 hop-limit

To configure the IPv6 hop limit as a key field for a flow record, use the match ipv6 hop-limit command in flow record configuration mode. To disable the use of a section of an IPv6 packet as a key field for a flow record, use the no form of this command.

match ipv6 hop-limit

no match ipv6 hop-limit

Syntax Description

This command has no arguments or keywords.

Command Default

The use of the IPv6 hop limit as a key field for a user-defined flow record is not enabled by default.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

Examples

The following example configures the hop limit of the packets in the flow as a key field:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match ipv6 hop-limit

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match ipv6 source address

To configure the IPv6 source address as a key field for a flow record, use the match ipv6 source address command in flow record configuration mode. To disable the use of the IPv6 source address as a key field for a flow record, use the no form of this command.

match ipv6 source address

no match ipv6 source address

Syntax Description

This command has no arguments or keywords.

Command Default

The IPv6 source address is not configured as a key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

To return this command to its default settings, use the no match ipv6 source address or default match ipv6 source address flow record configuration command.

Examples

The following example configures a IPv6 source address as a key field:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match ipv6 source address

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match transport

To configure one or more of the transport fields as a key field for a flow record, use the match transport command in flow record configuration mode. To disable the use of one or more of the transport fields as a key field for a flow record, use the no form of this command.

match transport { destination-port | icmp ipv4 | icmp ipv6 | igmp type | source-port }

no match transport { destination-port | icmp ipv4 | icmp ipv6 | igmp type | source-port }

Syntax Description

destination-port

Configures the transport destination port as a key field.

icmp ipv4

Configures the ICMP IPv4 type field and the code field as key fields. For more information see, match transport icmp ipv4.

icmp ipv6

Configures the ICMP IPv6 type field and the code field as key fields. For more information see, match transport icmp ipv6.

igmp type

Configures time stamps based on the system uptime as a key field.

source-port

Configures the transport source port as a key field.

Command Default

The transport fields are not configured as a key field.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

Examples

The following example configures the destination port as a key field:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match transport destination-port

The following example configures the source port as a key field:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match transport source-port

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match transport icmp ipv4

To configure the ICMP IPv4 type field and the code field as key fields for a flow record, use the match transport icmp ipv4 command in flow record configuration mode. To disable the use of the ICMP IPv4 type field and code field as key fields for a flow record, use the no form of this command.

match transport icmp ipv4 { code | type }

no match transport icmp ipv4 { code | type }

Syntax Description

code

Configures the IPv4 ICMP code as a key field.

type

Configures the IPv4 ICMP type as a key field.

Command Default

The ICMP IPv4 type field and the code field are not configured as key fields.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

Examples

The following example configures the IPv4 ICMP code field as a key field:

Controller(config)# flow record FLOW-RECORD-1 Controller(config-flow-record)# match transport icmp ipv4 code

The following example configures the IPv4 ICMP type field as a key field:

Controller(config)# flow record FLOW-RECORD-1 Controller(config-flow-record)# match transport icmp ipv4 type

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match transport icmp ipv6

To configure the ICMP IPv6 type field and the code field as key fields for a flow record, use the match transport icmp ipv6 command in flow record configuration mode. To disable the use of the ICMP IPv6 type field and code field as key fields for a flow record, use the no form of this command.

match transport icmp ipv6 { code | type }

no match transport icmp ipv6 { code | type }

Syntax Description

code

Configures the IPv6 ICMP code as a key field.

type

Configures the IPv6 ICMP type as a key field.

Command Default

The ICMP IPv6 type field and the code field are not configured as key fields.

Command Modes

Flow record configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields distinguish flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

Examples

The following example configures the IPv6 ICMP code field as a key field:

Controller(config)# flow record FLOW-RECORD-1 Controller(config-flow-record)# match transport icmp ipv6 code

The following example configures the IPv6 ICMP type field as a key field:

Controller(config)# flow record FLOW-RECORD-1 Controller(config-flow-record)# match transport icmp ipv6 type

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

match wireless ssid (wireless)

To configure the SSID of the wireless network as a key field for a flow record, use the match wireless ssid command in flow record configuration mode. To disable the use of the SSID of the wireless network as a key field for a flow record, use the no form of this command

match wireless ssid

no match wireless ssid

Syntax Description

This command has no arguments or keywords.

Command Default

The SSID of the wireless network is not configured as a key field.

Command Modes

Flow record configuration

Command History

Release

Modification

Cisco IOS XE 3.3SE

This command was introduced.

Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

Examples

The following example configures the SSID of the wireless network as a key field:

Controller(config)# flow record FLOW-RECORD-1
Controller(config-flow-record)# match wireless ssid

Related Commands

Command

Description

flow record

Creates a Flexible NetFlow flow record, or modifies an existing Flexible NetFlow flow record, and enters Flexible NetFlow flow record configuration mode.

mode random 1 out-of

To enable random sampling and to specify the packet interval for a Flexible NetFlow sampler, use the mode random 1 out-of command in sampler configuration mode. To remove the packet interval information for a Flexible NetFlow sampler, use the no form of this command.

mode random 1 out-of window-size

no mode

Syntax Description

window-size

Specifies the window size from which to select packets. The range is 2 to 1024.

Command Default

The mode and the packet interval for a sampler are not configured.

Command Modes

Sampler configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

A total of four unique samplers are supported on the controller. Packets are chosen in a manner that should eliminate any bias from traffic patterns and counter any attempt by users to avoid monitoring.


Note


The deterministic keyword is not supported, even though it is visible in the command-line help string.

Examples

The following example enables random sampling with a window size of 1000:

Controller(config)# sampler SAMPLER-1
Controller(config-sampler)# mode random 1 out-of 1000

Related Commands

Command

Description

debug sampler

Enables debugging output for Flexible NetFlow samplers.

show sampler

Displays the status and statistics for a Flexible NetFlow sampler.

option

To configure optional data parameters for a flow exporter for Flexible NetFlow, use the option command in flow exporter configuration mode. To remove optional data parameters for a flow exporter, use the no form of this command.

option { application-table | exporter-stats | interface-table | sampler-table | usermac-table } [ timeout seconds ]

no option { application-table | exporter-stats | interface-table | sampler-table | usermac-table }

Syntax Description

application-table

Configures the application table option for flow exporters.

This keyword is specific to the AVC feature. For more information, see the System Management Configuration Guide, Cisco IOS XE Release 3SE.

exporter-stats

Configures the exporter statistics option for flow exporters.

interface-table

Configures the interface table option for flow exporters.

sampler-table

Configures the export sampler table option for flow exporters.

usermac-table

(Optional) Configures the wireless usermac to username table option.

timeout seconds

(Optional) Configures the option resend time in seconds for flow exporters. The range is 1 to 86400. The default is 600.

Command Default

The timeout is 600 seconds. All other optional data parameters are not configured.

Command Modes

Flow exporter configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Cisco IOS XE 3.3SE

The application-table and usermac-table keywords were added.

Usage Guidelines

The option application-table command causes the periodic sending of an options table, which will allow the collector to map the Network Based Application Recognition (NBAR) application IDs provided in the flow records to application names. The optional timeout can alter the frequency at which the reports are sent. This keyword is specific to the AVC feature. For more information, see the System Management Configuration Guide, Cisco IOS XE Release 3SE.

The option exporter-stats command causes the periodic sending of the exporter statistics, including the number of records, bytes, and packets sent. This command allows the collector to estimate packet loss for the export records it receives. The optional timeout alters the frequency at which the reports are sent.

The option interface-table command causes the periodic sending of an options table, which allows the collector to map the interface SNMP indexes provided in the flow records to interface names. The optional timeout can alter the frequency at which the reports are sent.

The option usermac-table command causes the periodic sending of an options table, which allows the collector to map the user names of the wireless clients provided in the flow records to their MAC address. The optional timeout can alter the frequency at which the reports are sent.

The option sampler-table command causes the periodic sending of an options table, which details the configuration of each sampler and allows the collector to map the sampler ID provided in any flow record to a configuration that it can use to scale up the flow statistics. The optional timeout can alter the frequency at which the reports are sent.

To return this command to its default settings, use the no option or default option flow exporter configuration command.

Examples

The following example shows how to enable the periodic sending of the application option table, which allows the collector to map the application ID to the application name:

Controller(config)# flow exporter FLOW-EXPORTER-1 Controller(config-flow-exporter)# option application-table

The following example shows how to enable the periodic sending of the application option table at a lower frequency than usual, just once per day:

Controller(config)# flow exporter FLOW-EXPORTER-1 Controller(config-flow-exporter)#  option application-table timeout 86400

The following example shows how to enable the periodic sending of the sampler option table, which allows the collector to map the sampler ID to the sampler type and rate:

Controller(config)# flow exporter FLOW-EXPORTER-1 Controller(config-flow-exporter)# option sampler-table

The following example shows how to enable the periodic sending of the usermac option table, which allows the collector to map the wireless user mac to the user name:

Controller(config)# flow exporter FLOW-EXPORTER-1 Controller(config-flow-exporter)# option usermac-table

The following example shows how to enable the periodic sending of the exporter statistics, including the number of records, bytes, and packets sent:

Controller(config)# flow exporter FLOW-EXPORTER-1 Controller(config-flow-exporter)# option exporter-stats

The following example shows how to enable the periodic sending of an options table, which allows the collector to map the interface SNMP indexes provided in the flow records to interface names:

Controller(config)# flow exporter FLOW-EXPORTER-1 Controller(config-flow-exporter)# option interface-table

Related Commands

Command

Description

flow exporter

Creates a Flexible NetFlow flow exporter, or modifies an existing Flexible NetFlow flow exporter, and enters Flexible NetFlow flow exporter configuration mode.

record

To add a flow record for a Flexible NetFlow flow monitor, use the record command in flow monitor configuration mode. To remove a flow record for a Flexible NetFlow flow monitor, use the no form of this command.

record record-name

no record

Syntax Description

record-name

Name of a user-defined flow record that was previously configured.

Command Default

A flow record is not configured.

Command Modes

Flow monitor configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

Each flow monitor requires a record to define the contents and layout of its cache entries. The flow monitor can use one of the wide range of predefined record formats, or advanced users may create their own record formats.


Note


You must use the no ip flow monitor command to remove a flow monitor from all of the interfaces to which you have applied it before you can modify the parameters for the record command for the flow monitor.


Examples

The following example configures the flow monitor to use FLOW-RECORD-1:

Controller(config)# flow monitor FLOW-MONITOR-1
Controller(config-flow-monitor)# record FLOW-RECORD-1

Related Commands

Command

Description

flow monitor

Creates a flow monitor, or modifies an existing flow monitor, and enters flow monitor configuration mode.

sampler

To create a Flexible NetFlow flow sampler, or to modify an existing Flexible NetFlow flow sampler, and to enter Flexible NetFlow sampler configuration mode, use the sampler command in global configuration mode. To remove a sampler, use the no form of this command.

sampler sampler-name

no sampler sampler-name

Syntax Description

sampler-name

Name of the flow sampler that is being created or modified.

Command Default

Flexible NetFlow flow samplers are not configured.

Command Modes

Global configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

Flow samplers are used to reduce the load placed by Flexible NetFlow on the networking device to monitor traffic by limiting the number of packets that are analyzed. You configure a rate of sampling that is 1 out of a range of 2-1024 packets. Flow samplers are applied to interfaces in conjunction with a flow monitor to implement sampled Flexible NetFlow.

To enable flow sampling, you configure the record that you want to use for traffic analysis and assign it to a flow monitor. When you apply a flow monitor with a sampler to an interface, the sampled packets are analyzed at the rate specified by the sampler and compared with the flow record associated with the flow monitor. If the analyzed packets meet the criteria specified by the flow record, they are added to the flow monitor cache.

Examples

The following example creates a flow sampler name SAMPLER-1:

Controller(config)# sampler SAMPLER-1
Controller(config-sampler)#

Related Commands

Command

Description

debug sampler

Enables debugging output for Flexible NetFlow samplers.

mode

Specifies the type of sampling and the packet interval for a Flexible NetFlow sampler.

show sampler

Displays the status and statistics for a Flexible NetFlow sampler.

show flow exporter

To display flow exporter status and statistics, use the show flow exporter command in privileged EXEC mode.

show flow exporter [ broker [ detail | picture ] | export-ids netflow-v9 | [ name ] exporter-name [ statistics | templates ] | option application { engines | table } | statistics | templates ]

Syntax Description

broker

(Optional) Displays information about the state of the broker for the Flexible NetFlow flow exporter.

detail

(Optional) Displays detailed information about the flow exporter broker.

picture

(Optional) Displays a picture of the broker state.

export-ids netflow-v9

(Optional) Displays the NetFlow Version 9 export fields that can be exported and their IDs.

name

(Optional) Specifies the name of a flow exporter.

exporter-name

(Optional) Name of a flow exporter that was previously configured.

statistics

(Optional) Displays statistics for all flow exporters or for the specified flow exporter.

templates

(Optional) Displays template information for all flow exporters or for the specified flow exporter.

option application engines

(Optional) Displays the application engines option for flow exporters.

option application table

(Optional) Displays the application table option for flow exporters.

This option is specific to the AVC feature. For more information, see the System Management Configuration Guide, Cisco IOS XE Release 3SE.

Command Default

None

Command Modes

Privileged EXEC

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Examples

The following example displays the status and statistics for all of the flow exporters configured on a controller:

Controller# show flow exporter
Flow Exporter FLOW-EXPORTER-1:
  Description:              Exports to the datacenter
  Export protocol:          NetFlow Version 9
  Transport Configuration:
    Destination IP address: 192.168.0.1
    Source IP address:      192.168.0.2
    Transport Protocol:     UDP
    Destination Port:       9995
    Source Port:            55864
    DSCP:                   0x0
    TTL:                    255
    Output Features:        Used

This table describes the significant fields shown in the display:

Table 1 show flow exporter Field Descriptions

Field

Description

Flow Exporter

The name of the flow exporter that you configured.

Description

The description that you configured for the exporter, or the default description User defined.

Transport Configuration

The transport configuration fields for this exporter.

Destination IP address

The IP address of the destination host.

Source IP address

The source IP address used by the exported packets.

Transport Protocol

The transport layer protocol used by the exported packets.

Destination Port

The destination UDP port to which the exported packets are sent.

Source Port

The source UDP port from which the exported packets are sent.

DSCP

The differentiated services code point (DSCP) value.

TTL

The time-to-live value.

Output Features

Specifies whether the output-features command, which causes the output features to be run on Flexible NetFlow export packets, has been used or not.

The following example displays the status and statistics for all of the flow exporters configured on a controller:

Controller# show flow exporter name FLOW-EXPORTER-1 statistics
Flow Exporter FLOW-EXPORTER-1:
  Packet send statistics (last cleared 2w6d ago):
    Successfully sent:         0                     (0 bytes)


Related Commands

Command

Description

clear flow exporter

Clears the statistics for a Flexible NetFlow flow exporter.

debug flow exporter

Enables debugging output for Flexible NetFlow flow exporters.

flow exporter

Creates a Flexible NetFlow flow exporter, or modifies an existing Flexible NetFlow flow exporter, and enters Flexible NetFlow flow exporter configuration mode.

show flow interface

To display the Flexible NetFlow configuration and status for an interface, use the show flow interface command in privileged EXEC mode.

show flow interface [ type number ]

Syntax Description

type

(Optional) The type of interface on which you want to display Flexible NetFlow accounting configuration information.

number

(Optional) The number of the interface on which you want to display Flexible NetFlow accounting configuration information.

Command Modes

Privileged EXEC

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Examples

The following example displays the Flexible NetFlow accounting configuration on Ethernet interfaces 0/0 and 0/1:

Controller# show flow interface gigabitethernet1/0/1

Interface Ethernet1/0
        monitor:         FLOW-MONITOR-1
        direction:       Output
        traffic(ip):     on
Controller# show flow interface gigabitethernet1/0/2
Interface Ethernet0/0
        monitor:         FLOW-MONITOR-1
        direction:       Input
        traffic(ip):     sampler SAMPLER-2#

The table below describes the significant fields shown in the display.

Table 2 show flow interface Field Descriptions

Field

Description

Interface

The interface to which the information applies.

monitor

The name of the flow monitor that is configured on the interface.

direction:

The direction of traffic that is being monitored by the flow monitor.

The possible values are:

  • Input—Traffic is being received by the interface.
  • Output—Traffic is being transmitted by the interface.

traffic(ip)

Indicates if the flow monitor is in normal mode or sampler mode.

The possible values are:

  • on—The flow monitor is in normal mode.
  • sampler—The flow monitor is in sampler mode (the name of the sampler will be included in the display).

Related Commands

Command

Description

show flow monitor

Displays the status and statistics for a Flexible NetFlow flow monitor.

show flow monitor

To display the status and statistics for a Flexible NetFlow flow monitor, use the show flow monitor command in privileged EXEC mode.

show flow monitor [ broker [ detail | picture ] | [ name ] monitor-name [ cache [ format { csv | record | table } ] ] | provisioning | statistics ]

Syntax Description

broker

(Optional) Displays information about the state of the broker for the flow monitor

detail

(Optional) Displays detailed information about the flow monitor broker.

picture

(Optional) Displays a picture of the broker state.

name

(Optional) Specifies the name of a flow monitor.

monitor-name

(Optional) Name of a flow monitor that was previously configured.

cache

(Optional) Displays the contents of the cache for the flow monitor.

format

(Optional) Specifies the use of one of the format options for formatting the display output.

csv

(Optional) Displays the flow monitor cache contents in comma-separated variables (CSV) format.

record

(Optional) Displays the flow monitor cache contents in record format.

table

(Optional) Displays the flow monitor cache contents in table format.

provisioning

(Optional) Displays the flow monitor provisioning information.

statistics

(Optional) Displays the statistics for the flow monitor.

Command Modes

Privileged EXEC

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

The cache keyword uses the record format by default.

The uppercase field names in the display output of the show flowmonitor monitor-name cache command are key fields that Flexible NetFlow uses to differentiate flows. The lowercase field names in the display output of the show flow monitor monitor-name cache command are nonkey fields from which Flexible NetFlow collects values as additional data for the cache.

Examples

The following example displays the status for a flow monitor:

Controller# show flow monitor FLOW-MONITOR-1
 
Flow Monitor FLOW-MONITOR-1:
  Description:       Used for basic traffic analysis
  Flow Record:       flow-record-1
  Flow Exporter:     flow-exporter-1
                     flow-exporter-2
  Cache:
    Type:              normal
    Status:            allocated
    Size:              4096 entries / 311316 bytes
    Inactive Timeout:  15 secs
    Active Timeout:    1800 secs


This table describes the significant fields shown in the display.

Table 3 show flow monitor monitor-name Field Descriptions

Field

Description

Flow Monitor

Name of the flow monitor that you configured.

Description

Description that you configured or the monitor, or the default description User defined.

Flow Record

Flow record assigned to the flow monitor.

Flow Exporter

Exporters that are assigned to the flow monitor.

Cache

Information about the cache for the flow monitor.

Type

Flow monitor cache type. The value is always normal, as it is the only supported cache type.

Status

Status of the flow monitor cache.

The possible values are:

  • allocated—The cache is allocated.
  • being deleted—The cache is being deleted.
  • not allocated—The cache is not allocated.

Size

Current cache size.

Inactive Timeout

Current value for the inactive timeout in seconds.

Active Timeout

Current value for the active timeout in seconds.

The following example displays the status, statistics, and data for the flow monitor named FLOW-MONITOR-1:

Controller# show flow monitor FLOW-MONITOR-1 cache
  Cache type:                               Normal (Platform cache)
  Cache size:                              Unknown
  Current entries:                               1

  Flows added:                                   3
  Flows aged:                                    2
    - Active timeout      (   300 secs)          2

DATALINK MAC SOURCE ADDRESS INPUT:       0000.0000.1000
DATALINK MAC DESTINATION ADDRESS INPUT:  6400.F125.59E6
IPV6 SOURCE ADDRESS:                     2001:DB8::1
IPV6 DESTINATION ADDRESS:                2001:DB8:1::1
TRNS SOURCE PORT:                        1111
TRNS DESTINATION PORT:                   2222
IP VERSION:                              6
IP PROTOCOL:                             6
IP TOS:                                  0x05
IP TTL:                                  11
tcp flags:                               0x20
counter bytes long:                      132059538
counter packets long:                    1158417

This table describes the significant fields shown in the display.

Table 4 show flow monitor monitor-name cache Field Descriptions

Field

Description

Cache type

Flow monitor cache type. The value is always normal, as it is the only supported cache type.

Cache Size

Number of entries in the cache.

Current entries

Number of entries in the cache that are in use.

Flows added

Flows added to the cache since the cache was created.

Flows aged

Flows expired from the cache since the cache was created.

Active timeout

Current value for the active timeout in seconds.

Inactive timeout

Current value for the inactive timeout in seconds.

DATALINK MAC SOURCE ADDRESS INPUT

MAC source address of input packets.

DATALINK MAC DESTINATION ADDRESS INPUT

MAC destination address of input packets.

IPV6 SOURCE ADDRESS

IPv6 source address.

IPV6 DESTINATION ADDRESS

IPv6 destination address.

TRNS SOURCE PORT

Source port for the transport protocol.

TRNS DESTINATION PORT

Destination port for the transport protocol.

IP VERSION

IP version.

IP PROTOCOL

Protocol number.

IP TOS

IP type of service (ToS) value.

IP TTL

IP time-to-live (TTL) value.

tcp flags

Value of the TCP flags.

counter bytes

Number of bytes that have been counted.

counter packets

Number of packets that have been counted.

The following example displays the status, statistics, and data for the flow monitor named FLOW-MONITOR-1 in a table format:

Controller# show flow monitor FLOW-MONITOR-1 cache format table
  Cache type:                           Normal (Platform cache)
  Cache size:                          Unknown
  Current entries:                           1

  Flows added:                               3
  Flows aged:                                2
    - Active timeout      (   300 secs)      2

DATALINK MAC SRC ADDR INPUT  DATALINK MAC DST ADDR INPUT  IPV6 SRC ADDR  IPV6 DST ADDR  TRNS SRC PORT  TRNS DST PORT  IP VERSION  IP PROT  IP TOS  IP TTL  tcp flags  bytes long  pkts long
===========================  ===========================  =============  =============  =============  =============  ==========  =======  ======  ======  =========  ==========  =========
0000.0000.1000               6400.F125.59E6               2001:DB8::1    2001:DB8:1::1           1111           2222           6        6  0x05        11  0x20        132059538    1158417

The following example displays the status, statistics, and data for the flow monitor named FLOW-MONITOR-IPv6 (the cache contains IPv6 data) in record format:

Controller# show flow monitor name FLOW-MONITOR-IPv6 cache format record
  Cache type:                               Normal (Platform cache)
  Cache size:                              Unknown
  Current entries:                               1

  Flows added:                                   3
  Flows aged:                                    2
    - Active timeout      (   300 secs)          2

DATALINK MAC SOURCE ADDRESS INPUT:       0000.0000.1000
DATALINK MAC DESTINATION ADDRESS INPUT:  6400.F125.59E6
IPV6 SOURCE ADDRESS:                     2001::2
IPV6 DESTINATION ADDRESS:                2002::2
TRNS SOURCE PORT:                        1111
TRNS DESTINATION PORT:                   2222
IP VERSION:                              6
IP PROTOCOL:                             6
IP TOS:                                  0x05
IP TTL:                                  11
tcp flags:                               0x20
counter bytes long:                      132059538
counter packets long:                    1158417

The following example displays the status and statistics for a flow monitor:

Controller# show flow monitor FLOW-MONITOR-1 statistics
  Cache type:                               Normal (Platform cache)
  Cache size:                              Unknown
  Current entries:                               1

  Flows added:                                   3
  Flows aged:                                    2
    - Active timeout      (   300 secs)          2


Related Commands

Command

Description

clear flow monitor

Clears a flow monitor cache or flow monitor statistics and forces the export of the data in the flow monitor cache.

debug flow monitor

Enables debugging output for Flexible NetFlow flow monitors.

show flow record

To display the status and statistics for a Flexible NetFlow flow record, use the show flow record command in privileged EXEC mode.

show flow record [ broker [ detail | picture ] | [ name ] record-name ]

Syntax Description

broker

(Optional) Displays information about the state of the broker for the Flexible NetFlow flow record.

detail

(Optional) Displays detailed information about the flow record broker.

picture

(Optional) Displays a picture of the broker state.

name

(Optional) Specifies the name of a flow record.

record-name

(Optional) Name of a user-defined flow record that was previously configured.

Command Default

None

Command Modes

Privileged EXEC

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Examples

The following example displays the status and statistics for FLOW-RECORD-1:

Controller# show flow record FLOW-RECORD-1
flow record FLOW-RECORD-1:
  Description:        User defined
  No. of users:       0
  Total field space:  24 bytes
  Fields:
    match ipv6 destination address
    match transport source-port
    collect interface input


Related Commands

Command

Description

record

Configures a flow record for a Flexible NetFlow flow monitor.

show flow record wireless avc basic (wireless)

This command is specific to the AVC feature. To view default flow record information, use the show flow record wireless avc basic command in privileged EXEC mode.

show flow record wireless avc basic

Command Default

None

Command Modes

Privileged EXEC

Command History

Release

Modification

Cisco IOS XE 3.3SE

This command was introduced.

Usage Guidelines

If a user-defined flow record has not been specified, then the default flow record wireless avc basic is mapped to the flow monitor.

This command is specific to the AVC feature. For more information, see the System Management Configuration Guide, Cisco IOS XE Release 3SE.

Examples

This command is specific to the AVC feature. For examples, see the System Management Configuration Guide, Cisco IOS XE Release 3SE.

show sampler

To display the status and statistics for a Flexible NetFlow sampler, use the show sampler command in privileged EXEC mode.

show sampler [ broker [ detail | picture ] | [ name ] sampler-name ]

Syntax Description

broker

(Optional) Displays information about the state of the broker for the Flexible NetFlow sampler.

detail

(Optional) Displays detailed information about the sampler broker.

picture

(Optional) Displays a picture of the broker state.

name

(Optional) Specifies the name of a sampler.

sampler-name

(Optional) Name of a sampler that was previously configured.

Command Default

None

Command Modes

Privileged EXEC

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Examples

The following example displays the status and statistics for all of the flow samplers configured:

Controller# show sampler
Sampler SAMPLER-1:
  ID:             2083940135
  export ID:      0
  Description:    User defined
  Type:           Invalid (not in use)
  Rate:           1 out of 32
  Samples:        0
  Requests:       0
  Users (0):

Sampler SAMPLER-2:
  ID:             3800923489
  export ID:      1
  Description:    User defined
  Type:           random
  Rate:           1 out of 100
  Samples:        1
  Requests:       124
  Users (1):
    flow monitor FLOW-MONITOR-1 (datalink,vlan1)  0 out of 0

This table describes the significant fields shown in the display.

Table 5 show sampler Field Descriptions

Field

Description

ID

ID number of the flow sampler.

Export ID

ID of the flow sampler export.

Description

Description that you configured for the flow sampler, or the default description User defined.

Type

Sampling mode that you configured for the flow sampler.

Rate

Window size (for packet selection) that you configured for the flow sampler. The range is 2 to 32768.

Samples

Number of packets sampled since the flow sampler was configured or the controller was restarted. This is equivalent to the number of times a positive response was received when the sampler was queried to determine if the traffic needed to be sampled. See the explanation of the Requests field in this table.

Requests

Number of times the flow sampler was queried to determine if the traffic needed to be sampled.

Users

Interfaces on which the flow sampler is configured.


Related Commands

Command

Description

debug sampler

Enables debugging output for Flexible NetFlow samplers.

sampler

Creates a Flexible NetFlow flow sampler, or modifies an existing Flexible NetFlow flow sampler.

source

To configure the source IP address interface for all of the packets sent by a Flexible NetFlow flow exporter, use the source command in flow exporter configuration mode. To remove the source IP address interface for all of the packets sent by a Flexible NetFlow flow exporter, use the no form of this command.

source interface-type interface-number

no source

Syntax Description

interface-type

Type of interface whose IP address you want to use for the source IP address of the packets sent by a Flexible NetFlow flow exporter.

interface-number

Interface number whose IP address you want to use for the source IP address of the packets sent by a Flexible NetFlow flow exporter.

Command Default

The IP address of the interface over which the Flexible NetFlow datagram is transmitted is used as the source IP address.

Command Modes

Flow exporter configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

The benefits of using a consistent IP source address for the datagrams that Flexible NetFlow sends include the following:

  • The source IP address of the datagrams exported by Flexible NetFlow is used by the destination system to determine from which controller the Flexible NetFlow data is arriving. If your network has two or more paths that can be used to send Flexible NetFlow datagrams from the controller to the destination system and you do not specify the source interface from which the source IP address is to be obtained, the controller uses the IP address of the interface over which the datagram is transmitted as the source IP address of the datagram. In this situation the destination system might receive Flexible NetFlow datagrams from the same controller, but with different source IP addresses. When the destination system receives Flexible NetFlow datagrams from the same controller with different source IP addresses, the destination system treats the Flexible NetFlow datagrams as if they were being sent from different controllers. To avoid having the destination system treat the Flexible NetFlow datagrams as if they were being sent from different controllers, you must configure the destination system to aggregate the Flexible NetFlow datagrams it receives from all of the possible source IP addresses in the controller into a single Flexible NetFlow flow.
  • If your controller has multiple interfaces that can be used to transmit datagrams to the destination system, and you do not configure the source command, you will have to add an entry for the IP address of each interface into any access lists that you create for permitting Flexible NetFlow traffic. Creating and maintaining access lists for permitting Flexible NetFlow traffic from known sources and blocking it from unknown sources is easier when you limit the source IP address for Flexible NetFlow datagrams to a single IP address for each controller that is exporting Flexible NetFlow traffic.

Caution


The interface that you configure as the source interface must have an IP address configured, and it must be up.



Tip


When a transient outage occurs on the interface that you configured with the source command, the Flexible NetFlow exporter reverts to the default behavior of using the IP address of the interface over which the datagrams are being transmitted as the source IP address for the datagrams. To avoid this problem, use a loopback interface as the source interface because loopback interfaces are not subject to the transient outages that can occur on physical interfaces.


To return this command to its default settings, use the no source or default source flow exporter configuration command.

Examples

The following example shows how to configure Flexible NetFlow to use a loopback interface as the source interface for NetFlow traffic:

Controller(config)# flow exporter FLOW-EXPORTER-1
Controller(config-flow-exporter)# source loopback 0


Related Commands

Command

Description

flow exporter

Creates a Flexible NetFlow flow exporter, or modifies an existing Flexible NetFlow flow exporter, and enters Flexible NetFlow flow exporter configuration mode.

template data timeout

To specify a timeout period for resending flow exporter template data, use the template data timeout command in flow exporter configuration mode. To remove the template resend timeout for a flow exporter, use the no form of this command.

template data timeout seconds

no template data timeout seconds

Syntax Description

seconds

Timeout value in seconds. The range is 1 to 86400. The default is 600.

Command Default

The default template resend timeout for a flow exporter is 600 seconds.

Command Modes

Flow exporter configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

Flow exporter template data describes the exported data records. Data records cannot be decoded without the corresponding template. The template data timeout command controls how often those templates are exported.
To return this command to its default settings, use the no template data timeout or default template data timeout flow record exporter command.

Examples

The following example configures resending templates based on a timeout of 1000 seconds:

Controller(config)# flow exporter FLOW-EXPORTER-1
Controller(config-flow-exporter)# template data timeout 1000

Related Commands

Command

Description

flow exporter

Creates a Flexible NetFlow flow exporter, or modifies an existing Flexible NetFlow flow exporter, and enters Flexible NetFlow flow exporter configuration mode.

transport

To configure the transport protocol for a flow exporter for Flexible NetFlow, use the transport command in flow exporter configuration mode. To remove the transport protocol for a flow exporter, use the no form of this command.

transport udp udp-port

no transport udp udp-port

Syntax Description

udp udp-port

Specifies User Datagram Protocol (UDP) as the transport protocol and the UDP port number.

Command Default

Flow exporters use UDP on port 9995.

Command Modes

Flow exporter configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

To return this command to its default settings, use the no transport or default transport flow exporter configuration command.

Examples

The following example configures UDP as the transport protocol and a UDP port number of 250:

Controller(config)# flow exporter FLOW-EXPORTER-1
Controller(config-flow-exporter)# transport udp 250

Related Commands

Command

Description

flow exporter

Creates a Flexible NetFlow flow exporter, or modifies an existing Flexible NetFlow flow exporter, and enters Flexible NetFlow flow exporter configuration mode.

ttl

To configure the time-to-live (TTL) value, use the ttl command in flow exporter configuration mode. To remove the TTL value, use the no form of this command.

ttl ttl

no ttl ttl

Syntax Description

ttl

Time-to-live (TTL) value for exported datagrams. The range is 1 to 255. The default is 255.

Command Default

Flow exporters use a TTL of 255.

Command Modes

Flow exporter configuration

Command History

Release Modification

Cisco IOS XE 3.2SE

This command was introduced.

Usage Guidelines

To return this command to its default settings, use the no ttl or default ttl flow exporter configuration command.

Examples

The following example specifies a TTL of 15:

Controller(config)# flow exporter FLOW-EXPORTER-1
Controller(config-flow-exporter)# ttl 15

Related Commands

Command

Description

flow exporter

Creates a Flexible NetFlow flow exporter, or modifies an existing Flexible NetFlow flow exporter, and enters Flexible NetFlow flow exporter configuration mode.