Table Of Contents
Configuring NDE
Understanding NDE
NDE Overview
NDE on the RP
NDE on the PFC
NDE Flow Mask
Additional NDE Fields
NDE Versions
Exporting NetFlow Data
Sampled NetFlow
Default NDE Configuration
NDE Configuration Guidelines and Restrictions
Configuring NDE
Configuring NDE on the PFC
Enabling NDE From the PFC
Populating Additional NDE Fields
Configuring Sampled NetFlow
Configuring NDE on the RP
Configuring the RP NDE Source Layer 3 Interface
Configuring the NDE Destination
Configuring Sampled NetFlow
Enabling NDE for Ingress-Bridged IP Traffic
Displaying the NDE Address and Port Configuration
Configuring NDE Flow Filters
NDE Flow Filter Overview
Configuring a Port Flow Filter
Configuring a Host and Port Filter
Configuring a Host Flow Filter
Configuring a Protocol Flow Filter
Displaying the NDE Configuration
Configuring NDE
This chapter describes how to configure NetFlow Data Export (NDE).
Note For complete syntax and usage information for the commands used in this chapter, see these publications:
•The Cisco IOS Software Releases 12.2SX Command References at this URL:
http://www.cisco.com/en/US/docs/ios/mcl/122sx_mcl.html
•The Release 12.2 publications at this URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/index.htm
•NetFlow version 9 is described at this URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123_1/nfv9expf.htm
This chapter contains the following sections:
•Understanding NDE
•Default NDE Configuration
•NDE Configuration Guidelines and Restrictions
•Configuring NDE
Understanding NDE
These sections describe how NetFlow Data Export (NDE) works:
•NDE Overview
•NDE on the RP
NDE Overview
NetFlow collects traffic statistics by monitoring the packets that flow through the switch and storing the statistics in the NetFlow table. For more information about NetFlow, see Chapter 55, "Configuring NetFlow."
NetFlow Data Export (NDE) converts the NetFlow table statistics into records and exports the records to an external device, which is called a NetFlow collector.
In PFC3A mode, NDE exports statistics only for routed traffic. With modes other than PFC3A, you can configure NDE to export statistics for both routed and bridged traffic.
You can export IP unicast statistics using NDE record format versions 5, 7 or 9. Use NDE version 8 record format for NetFlow aggregation, and version 9 record format for IP multicast.
Exporting a large volume of statistics can significantly impact SP and RP CPU utilization. You can control the volume of records exported by configuring NDE flow filters to include or exclude flows from the NDE export. When you configure a filter, NDE exports only the flows that match the filter criteria.
You can configure up to two external data collector addresses. A second data collector improves the probability of receiving complete NetFlow data by providing redundant data streams.
NDE on the RP
NDE on the route processor (RP) exports statistics for flows routed in software. The RP supports NetFlow aggregation, described at this URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fswtch_c/swprt2/xcfnfov.htm#wp1001212
The RP also supports NetFlow ToS-based router aggregation, described at this URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120limit/120s/120s15/dtnfltos.htm
Sampled NetFlow on the RP is described at this URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122sb/cr/sbnf_r/nf_c1sb.htm#wp1026620
NetFlow version 9 is described at this URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123_1/nfv9expf.htm
NetFlow version 9 record formats are described at this URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124cg/honf_c/chap05/onf_bcf.htm#wp1180857
NDE on the PFC
NDE on the PFC exports statistics for flows routed or bridged in hardware. These sections describe NDE on the PFC in more detail:
•NDE Flow Mask
•NDE Versions
•Exporting NetFlow Data
•Sampled NetFlow
NDE Flow Mask
You can configure the minimum NetFlow flow mask for NDE. The NetFlow flow mask determines the granularity of the statistics gathered, which controls the volume of statistics for NDE to export.
For more details about flow masks, see Chapter 55, "Configuring NetFlow."
Additional NDE Fields
You can configure NDE to populate the following additional fields in the NDE packets:
•IP address of the next hop router
•Egress interface SNMP ifIndex
•BGP AS
These fields are populated by the software looking up the FIB table entry before sending out the NDE record to the collector. Therefore, these fields are blank when you use the show command to display the hardware NetFlow table.
NDE Versions
NetFlow version 9 is described at this URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123_1/nfv9expf.htm
NDE exports statistics for NetFlow aggregation flows using NDE version 8. The following document describes the version 8 header format:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fswtch_c/swprt2/xcfnfov.htm#wp1001212
NDE exports IP unicast traffic using NDE versions 5, 7 and 9.
Some fields in the flow records might not have values, depending on the current flow mask. Unsupported fields contain a zero (0).
The following tables describe the supported fields for NDE versions 5 and 7:
•Table 56-1—Version 5 header format
•Table 56-2—Version 7 header format
•Table 56-3—Version 5 flow record format
•Table 56-4—Version 7 flow record format
NetFlow version 9 record formats are described at this URL:
http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a00805e395a.html#wp1180857
Table 56-1 NDE Version 5 Header Format
Bytes
|
Content
|
Description
|
0-1
|
version
|
NetFlow export format version number
|
2-3
|
count
|
Number of flows exported in this packet (1-30)
|
4-7
|
SysUptime
|
Current time in milliseconds since router booted
|
8-11
|
unix_secs
|
Current seconds since 0000 UTC 1970
|
12-15
|
unix_nsecs
|
Residual nanoseconds since 0000 UTC 1970
|
16-19
|
flow_sequence
|
Sequence counter of total flows seen
|
20-21
|
engine_type
|
Type of flow switching engine
|
21-23
|
engine_id
|
Slot number of the flow switching engine
|
Table 56-2 NDE Version 7 Header Format
Bytes
|
Content
|
Description
|
0-1
|
version
|
NetFlow export format version number
|
2-3
|
count
|
Number of flows exported in this packet (1-30)
|
4-7
|
SysUptime
|
Current time in milliseconds since router booted
|
8-11
|
unix_secs
|
Current seconds since 0000 UTC 1970
|
12-15
|
unix_nsecs
|
Residual nanoseconds since 0000 UTC 1970
|
16-19
|
flow_sequence
|
Sequence counter of total flows seen
|
20-23
|
reserved
|
Unused (zero) bytes
|
Table 56-3 NDE Version 5 Flow Record Format
Bytes
|
Content
|
Description
|
Flow masks:
· X=Populated
|
Source
|
Destination
|
Destination Source
|
Destination Source Interface
|
Full
|
Full Interface
|
0-3
|
srcaddr
|
Source IP address
|
X
|
0
|
X
|
X
|
X
|
X
|
4-7
|
dstaddr
|
Destination IP address
|
0
|
X
|
X
|
X
|
X
|
X
|
8-11
|
nexthop
|
Next hop router's IP address1
|
0
|
|
A
|
A
|
A
|
A
|
12-13
|
input
|
Ingress interface SNMP ifIndex
|
0
|
0
|
0
|
X
|
0
|
X
|
14-15
|
output
|
Egress interface SNMP ifIndex3
|
0
|
|
A
|
A
|
A
|
A
|
16-19
|
dPkts
|
Packets in the flow
|
X
|
X
|
X
|
X
|
X
|
X
|
20-23
|
dOctets
|
Octets (bytes) in the flow
|
X
|
X
|
X
|
X
|
X
|
X
|
24-27
|
first
|
SysUptime at start of the flow (milliseconds)
|
X
|
X
|
X
|
X
|
X
|
X
|
28-31
|
last
|
SysUptime at the time the last packet of the flow was received (milliseconds)
|
X
|
X
|
X
|
X
|
X
|
X
|
32-33
|
srcport
|
Layer 4 source port number or equivalent
|
0
|
0
|
0
|
0
|
|
|
34-35
|
dstport
|
Layer 4 destination port number or equivalent
|
0
|
0
|
0
|
0
|
X
|
X
|
36
|
pad1
|
Unused (zero) byte
|
0
|
0
|
0
|
0
|
0
|
0
|
37
|
tcp_flags
|
Cumulative OR of TCP flags5
|
0
|
0
|
0
|
0
|
0
|
0
|
38
|
prot
|
Layer 4 protocol (for example, 6=TCP, 17=UDP)
|
0
|
0
|
0
|
0
|
X
|
X
|
39
|
tos
|
IP type-of-service byte
|
|
|
|
|
|
|
40-41
|
src_as
|
Autonomous system number of the source, either origin or peer
|
X
|
0
|
X
|
X
|
X
|
X
|
42-43
|
dst_as
|
Autonomous system number of the destination, either origin or peer
|
0
|
X
|
X
|
X
|
X
|
X
|
44-45
|
src_mask
|
Source address prefix mask bits
|
X
|
0
|
X
|
X
|
X
|
X
|
46-47
|
dst_mask
|
Destination address prefix mask bits
|
0
|
X
|
X
|
X
|
X
|
X
|
48
|
pad2
|
Pad 2
|
0
|
0
|
0
|
0
|
0
|
0
|
Table 56-4 NDE Version 7 Flow Record Format
Bytes
|
Content
|
Description
|
Flow masks:
· X=Populated
|
Source
|
Destination
|
Destination Source
|
Destination Source Interface
|
Full
|
Full Interface
|
0-3
|
srcaddr
|
Source IP address
|
X
|
0
|
X
|
X
|
X
|
X
|
4-7
|
dstaddr
|
Destination IP address
|
0
|
X
|
X
|
X
|
X
|
X
|
8-11
|
nexthop
|
Next hop router's IP address1
|
0
|
|
A
|
A
|
A
|
A
|
12-13
|
input
|
Ingress interface SNMP ifIndex
|
0
|
0
|
0
|
X
|
0
|
X
|
14-15
|
output
|
Egress interface SNMP ifIndex3
|
0
|
|
A
|
A
|
A
|
A
|
16-19
|
dPkts
|
Packets in the flow
|
X
|
X
|
X
|
X
|
X
|
X
|
20-23
|
dOctets
|
Octets (bytes) in the flow
|
X
|
X
|
X
|
X
|
X
|
X
|
24-27
|
First
|
SysUptime at start of the flow (milliseconds)
|
X
|
X
|
X
|
X
|
X
|
X
|
28-31
|
Last
|
SysUptime at the time the last packet of the flow was received (milliseconds)
|
X
|
X
|
X
|
X
|
X
|
X
|
32-33
|
srcport
|
Layer 4 source port number or equivalent
|
0
|
0
|
0
|
0
|
|
|
34-35
|
dstport
|
Layer 4 destination port number or equivalent
|
0
|
0
|
0
|
0
|
X
|
X
|
36
|
flags
|
Flow mask in use
|
X
|
X
|
X
|
X
|
X
|
X
|
37
|
tcp_flags
|
Cumulative OR of TCP flags5
|
0
|
0
|
0
|
0
|
0
|
0
|
38
|
prot
|
Layer 4 protocol (for example, 6=TCP, 17=UDP)
|
0
|
0
|
0
|
0
|
X
|
X
|
39
|
tos
|
IP type-of-service byte
|
|
|
|
|
|
|
40-41
|
src_as
|
Autonomous system number of the source, either origin or peer
|
X
|
0
|
X
|
X
|
X
|
X
|
42-43
|
dst_as
|
Autonomous system number of the destination, either origin or peer
|
0
|
X
|
X
|
X
|
X
|
X
|
44
|
src_mask
|
Source address prefix mask bits
|
X
|
0
|
X
|
X
|
X
|
X
|
45
|
dst_mask
|
Destination address prefix mask bits
|
0
|
X
|
X
|
X
|
X
|
X
|
46-47
|
pad2
|
Pad 2
|
0
|
0
|
0
|
0
|
0
|
0
|
48-51
|
MLS RP
|
IP address of MLS router
|
0
|
X
|
X
|
X
|
X
|
X
|
Exporting NetFlow Data
NetFlow maintains traffic statistics for each active flow in the NetFlow table and increments the statistics when packets within each flow are switched.
Periodically, NDE exports summarized traffic statistics for all expired flows, which the external data collector receives and processes.
Exported NetFlow data contains statistics for the flow entries in the NetFlow table that have expired since the last export. Flow entries in the NetFlow table expire and are flushed from the NetFlow table when one of the following conditions occurs:
•The entry ages out.
•The entry is cleared by the user.
•An interface goes down.
•Route flaps occur.
To ensure periodic reporting of continuously active flows, entries for continuously active flows expire at the end of the interval configured with the mls aging long command (default 32 minutes).
NDE packets go to the external data collector either when the number of recently expired flows reaches a predetermined maximum or after 30 seconds.
By default, all expired flows are exported unless they are filtered. If you configure a filter, NDE only exports expired and purged flows that match the filter criteria. NDE flow filters are stored in NVRAM and are not cleared when NDE is disabled. See the "Configuring NDE Flow Filters" section for NDE filter configuration procedures.
Sampled NetFlow
Use the Sampled NetFlow feature to export data for a subset of traffic in a flow instead of for all packets in the flow. Sampled NetFlow can substantially reduce the amount of data to be exported.
Sampled NetFlow always uses the interface-full flow mask.
If you are using either the interface-full or interface-destination-source flow masks, you can enable or disable sampled NetFlow on each Layer 3 interface. You can enable sampled NetFlow on a Layer 2 interface if you have enabled NetFlow for bridged traffic on that interface. For further details, see the "Enabling NetFlow for Ingress-Bridged IP Traffic" section on page 55-11.
You can configure sampled NetFlow to use time-based sampling or packet-based sampling.
Table 56-5 lists the time-based sampling rates and export intervals.
Table 56-5 Time-Based Sampling Rates, Sampling Times, and Export Intervals
Sampling Rate
|
Sampling Time (Milliseconds)
|
Export Interval (Milliseconds)
|
1 in 64
|
128
|
8192
|
1 in 128
|
64
|
8192
|
1 in 256
|
32
|
8192
|
1 in 512
|
16
|
8192
|
1 in 1024
|
8
|
8192
|
1 in 2048
|
4
|
8192
|
1 in 4096
|
4
|
16384
|
1 in 8192
|
4
|
32768
|
If you configure 64 as the rate, the sampled NefFlow feature uses traffic from the first 64 milliseconds of a flow every 8192 milliseconds. If the rate is 2048, the sampled NetFlow feature uses traffic from the first 4 milliseconds of a flow every 8192 milliseconds. With time-based sampled NetFlow, the export interval is not configurable.
Packet-based sampled NetFlow uses this formula to sample a flow: the number of times sampled is approximately the length divided by the rate (packets_in_flow/sampling_rate). For example, if the flow is 32,768 packets long and the sampling rate is 1024, the flow is sampled approximately 32 times (32,768/1,024). With packet-based sampled NetFlow, the export interval is configurable.
Default NDE Configuration
Table 56-6 shows the default NDE configuration.
Table 56-6 Default NDE Configuration
Feature
|
Default Value
|
NDE
|
Disabled
|
NDE of ingress bridged IP traffic
|
Disabled
|
NDE source addresses
|
None
|
NDE data collector address and UDP port
|
None
|
NDE filters
|
None
|
Populating additional NDE fields
|
Enabled
|
NDE Configuration Guidelines and Restrictions
When configuring NDE, follow these guidelines and restrictions:
•You must enable NetFlow on the PFC to export data for packets forwarded in hardware.
•When you configure NAT and NDE on an interface, the PFC sends all fragmented packets to the RP to be processed in software. (CSCdz51590)
•NDE supports IP multicast traffic only with NetFlow version 9.
•NetFlow aggregation must use NDE version 8 or version 9.
•Except in PFC3A mode, NDE supports bridged IP traffic. PFC3A mode does not support NDE for bridged IP traffic.
•NDE does not support Internetwork Packet Exchange (IPX) traffic or any other non-IP protocol.
Configuring NDE
These sections describe how to configure NDE:
•Configuring NDE on the PFC
•Configuring NDE on the RP
•Enabling NDE for Ingress-Bridged IP Traffic
•Displaying the NDE Address and Port Configuration
•Configuring NDE Flow Filters
•Displaying the NDE Configuration
Configuring NDE on the PFC
These sections describe how to configure NDE on the PFC:
•Enabling NDE From the PFC
•Populating Additional NDE Fields
•Configuring Sampled NetFlow
Enabling NDE From the PFC
To enable NDE from the PFC, perform this task:
Command
|
Purpose
|
Router(config)# mls nde sender [version {5 | 7}]
|
Enables NDE from the PFC and (optionally) configures the NDE version.
Do not use this command to enable version 9 records. Instead, use ip flow-export version 9, which is explained in the "Configuring NDE on the RP" section.
|
Router(config)# no mls nde sender
|
Disables NDE from the PFC.
|
Router(config)# no mls nde sender version
|
Reverts to the default (version 7).
|
Note•NDE from the PFC uses the source interface configured for the RP (see the "Configuring the RP NDE Source Layer 3 Interface" section).
•NetFlow version 9 is described at this URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123_1/nfv9expf.htm
This example shows how to enable NDE from the PFC:
Router(config)# mls nde sender
This example shows how to enable NDE from the PFC and configure NDE version 5:
Router(config)# mls nde sender version 5
Populating Additional NDE Fields
You can configure NDE to populate the following additional fields in the NDE packets:
•IP address of the next hop router
•Egress interface SNMP ifIndex
•BGP AS
Not all of the additional fields are populated with all flow masks. See the "NDE Versions" section for additional information.
To populate the additional fields in NDE packets, perform this task:
Command
|
Purpose
|
Router(config)# mls nde interface
|
Populates additional fields in NDE packets.
|
Router(config)# no mls nde interface
|
Disables population of the additional fields.
|
This example shows how to populate the additional fields in NDE packets:
Router(config)# mls nde interface
Configuring Sampled NetFlow
These sections describe how to configure sampled NetFlow on the PFC:
•Configuring Sampled NetFlow Globally
•Configuring Sampled NetFlow on a Layer 3 Interface
Configuring Sampled NetFlow Globally
To configure sampled NetFlow globally, perform this task:
|
Command
|
Purpose
|
Step 1
|
Router(config)# mls sampling {time-based rate |
packet-based rate [interval]}
|
Enables sampled NetFlow and configures the rate. For packet-based sampling, optionally configures the export interval.
|
Router(config)# no mls sampling
|
Clears the sampled NetFlow configuration.
|
Step 2
|
Router(config)# end
|
Exits configuration mode.
|
When you configure sampled NetFlow globally, note the following information:
•The valid values for rate are 64, 128, 256, 512, 1024, 2048, 4096, and 8192.
•The valid values for the packet-based export interval are from 8,000 through 16,000.
•To export any data, you must also configure sampled NetFlow on a Layer 3 interface.
Configuring Sampled NetFlow on a Layer 3 Interface
Note•With the full-interface or destination-source-interface flow masks, you can enable or disable sampled NetFlow on individual Layer 3 interfaces. With all other flow masks, sampled NetFlow is enabled or disabled globally.
•The Layer 3 interface must be configured with an IP address.
To configure sampled NetFlow on a Layer 3 interface, perform this task:
|
Command
|
Purpose
|
Step 1
|
Router(config)# interface {vlan vlan_ID |
type slot/port}
|
Selects a Layer 3 interface to configure.
|
Step 2
|
Router(config-if)# mls netflow sampling
|
Enables sampled NetFlow on the Layer 3 interface.
|
Router(config-if)# no mls netflow sampling
|
Disables sampled NetFlow on the Layer 3 interface.
|
Step 3
|
Router(config)# end
|
Exits configuration mode.
|
This example shows how to enable sampled NetFlow on Fast Ethernet port 5/12:
Router# configure terminal
Router(config)# interface fastethernet 5/12
Router(config-if)# mls netflow sampling
Configuring NDE on the RP
These sections describe how to configure NDE on the RP:
•Configuring the RP NDE Source Layer 3 Interface
•Configuring the NDE Destination
•Configuring Sampled NetFlow
Configuring the RP NDE Source Layer 3 Interface
To configure the Layer 3 interface used as the source of the NDE packets containing statistics from the RP, perform this task:
Command
|
Purpose
|
Router(config)# ip flow-export source {{vlan vlan_ID}
| {type slot/port} | {port-channel number} |
{loopback number}}
|
Configures the interface used as the source of the NDE packets containing statistics from the RP.
|
Router(config)# no ip flow-export source
|
Clears the NDE source interface configuration.
|
When configuring the RP NDE source Layer 3 interface, note the following information:
•You must select an interface configured with an IP address.
•You can use a loopback interface.
This example shows how to configure a loopback interface as the NDE flow source:
Router(config)# ip flow-export source loopback 0
Configuring the NDE Destination
To configure the destination IP address and UDP port to receive the NDE statistics, perform this task:
Command
|
Purpose
|
Router(config)# ip flow-export destination ip_address
udp_port_number [vrf vrf_name]
|
Configures the NDE destination IP address and UDP port.
(Optional) Specify a VPN routing/forwarding table name.
|
Router(config)# no ip flow-export destination
ip_address udp_port_number [vrf vrf_name]
|
Clears the NDE destination configuration.
|
Note NetFlow Multiple Export Destinations—To configure redundant NDE data streams, which improves the probability of receiving complete NetFlow data, you can enter the ip flow-export destination command twice and configure a different destination IP address in each command. Configuring two destinations increases the RP CPU utilization, as you are exporting the data records twice.
This example shows how to configure the NDE flow destination IP address and UDP port:
Router(config)# ip flow-export destination 172.20.52.37 200
Note The destination address and UDP port number are saved in NVRAM and are preserved if NDE is disabled and reenabled or if the switch is power cycled. If you are using the NetFlow FlowCollector application for data collection, verify that the UDP port number you configure is the same port number shown in the FlowCollector's /opt/csconfc/config/nfconfig.file file.
Configuring Sampled NetFlow
The RP supports sampled NetFlow for software-routed traffic.
For additional information, see the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122sb/cr/sbnf_r/nf_c1sb.htm#wp1026620
Enabling NDE for Ingress-Bridged IP Traffic
Except in PFC3A mode, NDE supports ingress-bridged IP traffic. PFC3A mode does not support NDE for bridged IP traffic.
NDE is enabled by default when you enable NetFlow on the VLAN. For additional information, see "Configuring NetFlow on Layer 3 Interfaces" section on page 55-11.
To disable NDE for ingress-bridged IP traffic in VLANs, perform this task:
Command
|
Purpose
|
Router(config)# ip flow export layer2-switched
vlan vlan_ID[-vlan_ID] [, vlan_ID[-vlan_ID]]
|
Enables NDE for ingress-bridged IP traffic in the specified VLANs (enabled by default when you enter the ip flow ingress layer2-switched vlan command).
Note NDE for ingress-bridged IP traffic in a VLAN requires that NDE on the PFC be enabled with the mls nde sender command.
|
Router(config)# no ip flow export layer2-switched
vlan vlan_ID[-vlan_ID] [, vlan_ID[-vlan_ID]]
|
Disables NDE for ingress-bridged IP traffic in the specified VLANs.
|
This example shows how to enable NDE for ingress bridged IP traffic in VLAN 200:
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# ip flow export layer2-switched vlan 200
Displaying the NDE Address and Port Configuration
To display the NDE address and port configuration, perform these tasks:
Command
|
Purpose
|
Router# show mls nde
|
Displays NDE information for hardware flows including the NDE export flow IP address, UDP port, and the NDE source interface configuration.
|
Router# show ip flow export
|
Displays NDE information for software flows including the NDE export flow IP address, UDP port, and the NDE source interface configuration.
|
This example shows how to display the NDE export flow source IP address and UDP port configuration:
Netflow Data Export enabled
Exporting flows to 10.34.12.245 (9999)
Exporting flows from 10.6.58.7 (55425)
Include Filter not configured
source: ip address 11.1.1.0, mask 255.255.255.0
Total Netflow Data Export Packets are:
49 packets, 0 no packets, 247 records
Total Netflow Data Export Send Errors:
IPWRITE_ENQUEUE_FAILED = 0
IPWRITE_OUTPUT_FAILED = 0
IPWRITE_ENCAPFIX_FAILED = 0
Netflow Aggregation Enabled
source-prefix aggregation export is disabled
destination-prefix aggregation exporting flows to 10.34.12.245 (9999)
exported 84 packets, 94 records
prefix aggregation export is disabled
This example shows how to display the NDE export flow IP address, UDP port, and the NDE source interface configuration:
Router# show ip flow export
Exporting flows to 172.20.52.37 (200)
Exporting using source interface FastEthernet5/8
0 flows exported in 0 udp datagrams
0 flows failed due to lack of export packet
0 export packets were sent up to process level
0 export packets were dropped due to no fib
0 export packets were dropped due to adjacency issues
Configuring NDE Flow Filters
These sections describe NDE flow filters:
•NDE Flow Filter Overview
•Configuring a Port Flow Filter
•Configuring a Host and Port Filter
•Configuring a Host Flow Filter
•Configuring a Protocol Flow Filter
NDE Flow Filter Overview
By default, all expired flows are exported until you configure a filter. After you configure a filter, only expired and purged flows matching the specified filter criteria are exported. Filter values are stored in NVRAM and are not cleared when NDE is disabled.
To display the configuration of the NDE flow filters you configure, use the show mls nde command described in the "Displaying the NDE Configuration" section.
Configuring a Port Flow Filter
To configure a destination or source port flow filter, perform this task:
Command
|
Purpose
|
Router(config)# mls nde flow {exclude | include}
{dest-port number | src-port number}
|
Configures a port flow filter for an NDE flow.
|
Router(config)# no mls nde flow {exclude | include}
|
Clears the port flow filter configuration.
|
This example shows how to configure a port flow filter so that only expired flows to destination port 23 are exported (assuming the flow mask is set to full):
Router(config)# mls nde flow include dest-port 23
Configuring a Host and Port Filter
To configure a host and TCP/UDP port flow filter, perform this task:
Command
|
Purpose
|
Router(config)# mls nde flow {exclude | include}
{destination ip_address mask | source ip_address mask
{dest-port number | src-port number}}
|
Configures a host and port flow filter for an NDE flow.
|
Router(config)# no mls nde flow {exclude | include}
|
Clears the port flow filter configuration.
|
This example shows how to configure a source host and destination TCP/UDP port flow filter so that only expired flows from host 171.69.194.140 to destination port 23 are exported (assuming the flow mask is set to ip-flow):
Router(config)# mls nde flow include source 171.69.194.140 255.255.255.255 dest-port 23
Configuring a Host Flow Filter
To configure a destination or source host flow filter, perform this task:
Command
|
Purpose
|
Router(config)# mls nde flow {exclude | include}
{destination ip_address mask | source ip_address mask
| protocol {tcp {dest-port number | src-port number}
| udp {dest-port number | src-port number}}
|
Configures a host flow filter for an NDE flow.
|
Router(config)# no mls nde flow {exclude | include}
|
Clears port filter configuration.
|
This example shows how to configure a host flow filter to export only flows to destination host 172.20.52.37:
Router(config)# mls nde flow include destination 172.20.52.37 255.255.255.225
Configuring a Protocol Flow Filter
To configure a protocol flow filter, perform this task:
Command
|
Purpose
|
Router(config)# mls nde flow {exclude | include}
protocol {tcp {dest-port number | src-port number} |
udp {dest-port number | src-port number}}
|
Configures a protocol flow filter for an NDE flow.
|
Router(config)# no mls nde flow {exclude | include}
|
Clears port filter configuration.
|
This example shows how to configure a TCP protocol flow filter so that only expired flows from destination port 35 are exported:
Router(config)# mls nde flow include protocol tcp dest-port 35
To display the status of the NDE flow filters, use the show mls nde command described in the "Displaying the NDE Configuration" section.
Displaying the NDE Configuration
To display the NDE configuration, perform this task:
Command
|
Purpose
|
Router# show mls nde
|
Displays the NDE configuration.
|
This example shows how to display the NDE configuration:
Netflow Data Export enabled
Exporting flows to 10.34.12.245 (9988) 10.34.12.245 (9999)
Exporting flows from 10.6.58.7 (57673)
Include Filter not configured
Exclude Filter not configured
Total Netflow Data Export Packets are:
508 packets, 0 no packets, 3985 records
Total Netflow Data Export Send Errors:
IPWRITE_ENQUEUE_FAILED = 0
IPWRITE_OUTPUT_FAILED = 0
IPWRITE_ENCAPFIX_FAILED = 0
Netflow Aggregation Enabled