Table Of Contents

Configuring NetFlow Aggregation Caches

Contents

Prerequisites for Configuring NetFlow Aggregation Caches

NetFlow Aggregation Caches

Restrictions for Configuring NetFlow Aggregation Caches

NetFlow Data Export

Information About Configuring NetFlow Aggregation Caches

NetFlow Aggregation Caches

NetFlow Cache Aggregation Benefits

NetFlow Cache Aggregation Schemes

NetFlow Aggregation Scheme Fields

NetFlow AS Aggregation Scheme

NetFlow AS-ToS Aggregation Scheme

NetFlow Destination Prefix Aggregation Scheme

NetFlow Destination Prefix-ToS Aggregation Scheme

NetFlow Prefix Aggregation Scheme

NetFlow Prefix-Port Aggregation Scheme

NetFlow Prefix-ToS Aggregation Scheme

NetFlow Protocol Port Aggregation Scheme

NetFlow Protocol-Port-ToS Aggregation Scheme

NetFlow Source Prefix Aggregation Scheme

NetFlow Source Prefix-ToS Aggregation Scheme

NetFlow Data Export Format Versions 9, and 8 for NetFlow Aggregation Caches: Overview

How to Configure NetFlow Aggregation Caches

Configuring NetFlow Aggregation Caches

Verifying the Aggregation Cache Configuration

Configuration Examples for Configuring NetFlow Aggregation Caches

Configuring an AS Aggregation Cache: Example

Configuring a Destination Prefix Aggregation Cache: Example

Configuring a Prefix Aggregation Cache: Example

Configuring a Protocol Port Aggregation Cache: Example

Configuring a Source Prefix Aggregation Cache: Example

Configuring an AS-ToS Aggregation Cache: Example

Configuring a Prefix-ToS Aggregation Cache: Example

Configuring the Minimum Mask of a Prefix Aggregation Scheme: Example

Configuring the Minimum Mask of a Destination Prefix Aggregation Scheme: Example

Configuring the Minimum Mask of a Source Prefix Aggregation Scheme: Example

Configuring NetFlow Version 9 Data Export for Aggregation Caches: Example

Configuring NetFlow Version 8 Data Export for Aggregation Caches: Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Glossary

Feature Information for Configuring NetFlow Aggregation Caches

Configuring NetFlow Aggregation Caches

---

This module contains information about and instructions for configuring NetFlow aggregation caches. The NetFlow main cache is the default cache used to store the data captured by NetFlow. By maintaining one or more extra caches, called aggregation caches, the NetFlow Aggregation feature allows limited aggregation of NetFlow data export streams on a router. The aggregation scheme that you select determines the specific kinds of data that are exported to a remote host.

NetFlow is a Cisco IOS application that provides statistics on packets flowing through the router. It is emerging as a primary network accounting and security technology.

Module History

This module was first published on May 2, 2005, and last updated on February 16th, 2006.

Finding Feature Information in This Module

Your Cisco IOS software release may not support all features. To find information about feature support and configuration, use the "Feature Information for Configuring NetFlow Aggregation Caches and Schemes" section on page 46.

Contents

•Prerequisites for Configuring NetFlow Aggregation Caches and Schemes, page 2

•Restrictions for Configuring NetFlow Aggregation Caches and Schemes, page 2

•Information About Configuring NetFlow Aggregation Caches and Schemes, page 2

•How to Configure NetFlow Aggregation Caches and Schemes, page 23

•Configuration Examples for Configuring NetFlow Aggregation Caches and Schemes, page 38

•Additional References, page 42

•Glossary, page 45

•Feature Information for Configuring NetFlow Aggregation Caches and Schemes, page 46

Prerequisites for Configuring NetFlow Aggregation Caches

NetFlow Aggregation Caches

Before you enable NetFlow you must:

•Configure the router for IP routing

•Ensure that one of the following is enabled on your router, and on the interfaces that you want to configure NetFlow on: Cisco Express Forwarding (CEF), distributed CEF, or fast switching

•Understand the resources required on your router because NetFlow consumes additional memory and CPU resources

If you intend to use Version 8 export format with an aggregation cache, configure Version 5 export format for the main cache.

If you need autonomous system (AS) information from the aggregation, make sure to specify either the peer-as or origin-as keyword in your export command if you have not configured an export format version.

You must explicitly enable each NetFlow aggregation cache by entering the enabled keyword from aggregation cache configuration mode.

Router-based aggregation must be enabled for minimum masking.

Restrictions for Configuring NetFlow Aggregation Caches

Cisco IOS Releases 12.2(14)S, 12.0(22)S, or 12.2(15)T

If your router is running a version of Cisco IOS prior to releases 12.2(14)S, 12.0(22)S, or 12.2(15)T the ip route-cache flow command is used to enable NetFlow on an interface.

If your router is running Cisco IOS release 12.2(14)S, 12.0(22)S, 12.2(15)T, or later the ip flow ingress command is used to enable NetFlow on an interface.

Memory Impact

During times of heavy traffic, the additional flows can fill up the global flow hash table. If you need to increase the size of the global flow hash table, increase the memory of the router.

Performance Impact

Configuring Egress NetFlow accounting with the ip flow egress command might adversely affect network performance because of the additional accounting-related computation that occurs in the traffic-forwarding path of the router.

NetFlow Data Export

Restrictions for NetFlow Version 9 Data Export

•Backward compatibility—Version 9 is not backward-compatible with Version 5 or Version 8. If you need Version 5 or Version 8, you must configure it.

•Export bandwidth—Export bandwidth use increases for Version 9 (because of template flowsets) versus Version 5. The increase in bandwidth usage versus Version 5 varies with the frequency with which template flowsets are sent. The default is to resend templates every 20 packets, which has a bandwidth cost of about 4 percent. If necessary, you can lower the resend rate with the ip flow-export template refresh-rate packets command.

•Performance impact—Version 9 slightly decreases overall performance, because generating and maintaining valid template flowsets require additional processing.

Restrictions for NetFlow Version 8 Export Format

Version 8 export format is available only for aggregation caches, and it cannot be expanded to support new features.

Information About Configuring NetFlow Aggregation Caches

Before configuring the NetFlow main cache, NetFlow aggregation caches and NetFlow aggregation schemes, you should understand the following information:

•NetFlow Aggregation Caches

•NetFlow Data Export Format Versions 9, and 8 for NetFlow Aggregation Caches: Overview

NetFlow Aggregation Caches

•NetFlow Cache Aggregation Benefits

•NetFlow Cache Aggregation Schemes

•NetFlow Aggregation Scheme Fields

•NetFlow AS Aggregation Scheme

•NetFlow AS-ToS Aggregation Scheme

•NetFlow Destination Prefix Aggregation Scheme

•NetFlow Destination Prefix-ToS Aggregation Scheme

•NetFlow Prefix Aggregation Scheme

•NetFlow Prefix-Port Aggregation Scheme

•NetFlow Prefix-ToS Aggregation Scheme

•NetFlow Protocol Port Aggregation Scheme

•NetFlow Protocol-Port-ToS Aggregation Scheme

•NetFlow Source Prefix Aggregation Scheme

•NetFlow Source Prefix-ToS Aggregation Scheme

NetFlow Cache Aggregation Benefits

Aggregation of export data is typically performed by NetFlow collection tools on management workstations. Router-based aggregation allows limited aggregation of NetFlow export records to occur on the router. Thus, you can summarize NetFlow export data on the router before the data is exported to a NetFlow data collection system, which has the following benefits:

•Reduces the bandwidth required between the router and the workstations

•Reduces the number of collection workstations required

•Improves performance and scalability on high flow-per-second routers

NetFlow Cache Aggregation Schemes

Cisco IOS NetFlow aggregation maintains one or more extra caches with different combinations of fields that determine which flows are grouped together. These extra caches are called aggregation caches. The combinations of fields that make up an aggregation cache are referred to as schemes. As flows expire from the main cache, they are added to each enabled aggregation cache.

You can configure each aggregation cache with its individual cache size, cache ager timeout parameter, export destination IP address, and export destination UDP port. As data flows expire in the main cache (depending on the aggregation scheme configured), relevant information is extracted from the expired flow and the corresponding flow entry in the aggregation cache is updated. The normal flow ager process runs on each active aggregation cache the same way it runs on the main cache. On-demand aging is also supported. Each aggregation cache contains different field combinations that determine which data flows are grouped. The default aggregation cache size is 4096 bytes.

You configure a cache aggregation scheme through the use of arguments to the ip flow-aggregation cache command. NetFlow supports the following five non-ToS based cache aggregation schemes:

•Autonomous system (AS) aggregation scheme

•Destination prefix aggregation scheme

•Prefix aggregation scheme

•Protocol port aggregation scheme

•Source prefix aggregation scheme

The NetFlow Type of Service (ToS)-Based Router Aggregation feature introduced support for additional cache aggregation schemes, all of which include the ToS byte as one of the fields in the aggregation cache. The following are the six ToS-based aggregation schemes:

•AS-ToS aggregation scheme

•Destination prefix-ToS aggregation scheme

•Prefix-port aggregation scheme

•Prefix-ToS aggregation scheme

•Protocol-port-ToS aggregation scheme

•Source prefix-ToS aggregation scheme

Figure 1 shows an example of how the main NetFlow cache can be aggregated into multiple aggregation caches based upon user-configured aggregation schemes.

Figure 1 Building a NetFlow Aggregation Cache

NetFlow Aggregation Scheme Fields

Each cache aggregation scheme contains field combinations that differ from any other cache aggregation scheme. The combination of fields determines which data flows are grouped and collected when a flow expires from the main cache. A flow is a set of packets that has common fields, such as the source IP address, destination IP address, protocol, source and destination ports, type-of-service, and the same interface on which the flow is monitored. To manage flow aggregation on your router, you need to configure the aggregation cache scheme that groups and collects the fields from which you want to examine data. Table 1 and Table 2 show the NetFlow fields that are grouped and collected for non-ToS and ToS based cache aggregation schemes.

Table 1 shows the NetFlow fields used in the non-TOS based aggregation schemes.

Table 1 NetFlow Fields Used in the Non-ToS Based Aggregations Schemes 

Field	AS	Protocol Port	Source Prefix	Destination Prefix	Prefix
Source prefix			X		X
Source prefix mask			X		X
Destination prefix				X	X
Destination prefix mask				X	X
Source app port		X
Destination app port		X
Input interface	X		X		X
Output interface	X			X	X
IP protocol		X
Source AS	X		X		X
Destination AS	X			X	X
First time stamp	X	X	X	X	X
Last time stamp	X	X	X	X	X
Number of flows	X	X	X	X	X
Number of packets	X	X	X	X	X
Number of bytes	X	X	X	X	X

Table 2 shows the NetFlow fields used in the TOS based aggregation schemes.

Table 2 NetFlow Fields Used in the ToS Based Aggregation Schemes 

Field	AS-ToS	Protocol Port-ToS	Source Prefix-ToS	Destination Prefix-ToS	Prefix-ToS	Prefix-Port
Source prefix			X		X	X
Source prefix mask			X		X	X
Destination prefix				X	X	X
Destination prefix mask				X	X	X
Source app port		X				X
Destination app port		X				X
Input interface	X	X	X		X	X
Output interface	X	X		X	X	X
IP protocol		X				X
Source AS	X		X		X
Destination AS	X			X	X
ToS	X	X	X	X	X	X
First time stamp	X	X	X	X		X
Last time stamp	X	X	X	X		X
Number of flows	X	X	X	X		X
Number of packets	X	X	X	X		X
Number of bytes	X	X	X	X		X

NetFlow AS Aggregation Scheme

The NetFlow AS aggregation scheme reduces NetFlow export data volume substantially and generates AS-to-AS traffic flow data. The scheme groups data flows that have the same source BGP AS, destination BGP AS, input interface, and output interface.

The aggregated NetFlow data export records report the following:

•Source and destination BGP AS

•Number of packets summarized by the aggregated record

•Number of flows summarized by the aggregated record

•Number of bytes summarized by the aggregated record

•Source interface

•Destination interface

•Time stamp when the first packet was switched and time stamp when the last packet was switched

Figure 2 shows the data export format for the AS aggregation scheme. For a definition of the data export terms used in the aggregation scheme, see Table 3.

Figure 2 Data Export Format for AS Aggregation Scheme

Table 3 lists definitions for the data export record fields used in the AS aggregation scheme.

Table 3 Data Export Record Field Definitions for AS Aggregation Scheme 

Field	Definition
Flows	Number of main cache flows that were aggregated
Packets	Number of packets in the aggregated flows
Bytes	Number of bytes in the aggregated flows
First time stamp	System uptime when the first packet was switched
Last time stamp	System uptime when the last packet was switched
Source AS	Autonomous system of the source IP address (peer or origin)
Destination AS	Autonomous system of the destination IP address (peer or origin)
Source interface	SNMP index of the input interface
Destination interface	SNMP index of the output interface

NetFlow AS-ToS Aggregation Scheme

The NetFlow AS-ToS aggregation scheme groups flows that have the same source BGP AS, destination BGP AS, source and destination interfaces, and ToS byte. The aggregated NetFlow export record based on the AS-ToS aggregation scheme reports the following:

•Source BGP AS

•Destination BGP AS

•ToS byte

•Number of flows summarized by the aggregated record

•Number of bytes summarized by this aggregated record

•Number of packets summarized by this aggregation record

•Source and destination interface

•Time stamp when the first packet was switched and time stamp when the last packet was switched

This aggregation scheme is particularly useful for generating AS-to-AS traffic flow data, and for reducing NetFlow export data volume substantially. Figure 3 show the data export format for the AS-ToS aggregation scheme. For a definition of the data export terms used in the aggregation scheme, see Table 4.

Figure 3 Data Export Format for AS-ToS Aggregation Scheme

Table 4 lists definitions for the data export record terms used in the AS-ToS aggregation scheme.

Table 4 Data Export Record Term Definitions for AS-ToS Aggregation Scheme 

Term	Definition
Flows	Number of main cache flows that were aggregated
Packets	Number of packets in the aggregated flows
Bytes	Number of bytes in the aggregated flows
First time stamp	System uptime when the first packet was switched
Last time stamp	System uptime when the last packet was switched
Source AS	Autonomous system of the source IP address (peer or origin)
Destination AS	Autonomous system of the destination IP address (peer or origin)
Source interface	SNMP index of the input interface
Destination interface	SNMP index of the output interface
ToS	Type of service byte
PAD	Zero field
Reserved	Zero field

NetFlow Destination Prefix Aggregation Scheme

The destination prefix aggregation scheme generates data so that you can examine the destinations of network traffic passing through a NetFlow-enabled device. The scheme groups data flows that have the same destination prefix, destination prefix mask, destination BGP AS, and output interface.

The aggregated NetFlow data export records report the following:

•Destination prefix

•Destination prefix mask

•Destination BGP AS

•Number of flows summarized by the aggregated record

•Number of bytes summarized by the aggregated record

•Number of packets summarized by the aggregated record

•Output interface

•Time stamp when the first packet was switched and time stamp when the last packet was switched

Figure 4 shows the data export format for the destination prefix aggregation scheme. For a definition of the data export terms used in the aggregation scheme, see Table 5.

Figure 4 Destination Prefix Aggregation Data Export Record Format

Table 5 lists definitions for the data export record terms used in the destination prefix aggregation scheme.

Table 5 Data Export Record Term Definitions for Destination Prefix Aggregation Scheme 

Term	Definition
Flows	Number of main cache flows that were aggregated
Packets	Number of packets in the aggregated flows
Bytes	Number of bytes in the aggregated flows
First time stamp	System uptime when the first packet was switched
Last time stamp	System uptime when the last packet was switched
Destination prefix	Destination IP address ANDed with the destination prefix mask
Destination mask bits	Number of bits in the destination prefix
PAD	Zero field
Destination AS	Autonomous system of the destination IP address (peer or origin)
Destination interface	SNMP index of the output interface
Reserved	Zero field

NetFlow Destination Prefix-ToS Aggregation Scheme

The NetFlow destination prefix-ToS aggregation scheme groups flows that have the same destination prefix, destination prefix mask, destination BGP AS, ToS byte, and output interface. The aggregated NetFlow export record reports the following:

•Destination IP address

•Destination prefix mask

•Destination AS

•ToS byte

•Number of flows summarized by the aggregated record

•Number of bytes summarized by the aggregated record

•Number of packets summarized by the aggregated record

•Output interface

•Time stamp when the first packet was switched and time stamp when the last packet was switched

This aggregation scheme is particularly useful for capturing data with which you can examine the destinations of network traffic passing through a NetFlow-enabled device. Figure 5 shows the data export format for the Destination prefix-ToS aggregation scheme. For a definition of the data export terms used in the aggregation scheme, see Table 6.

Figure 5 Data Export Format for Destination Prefix-ToS Aggregation Scheme

Table 6 lists definitions for the data export record terms used in the destination prefix-ToS aggregation scheme.

Table 6 Data Export Record Term Definitions for Destination Prefix-ToS Aggregation Scheme 

Term	Definition
Flows	Number of main cache flows that were aggregated
Packets	Number of packets in the aggregated flows
Bytes	Number of bytes in the aggregated flows
First time stamp	System uptime when the first packet was switched
Last time stamp	System uptime when the last packet was switched
Destination prefix	Destination IP address ANDed with the destination prefix mask
Dest mask bits	Number of bits in the destination prefix
ToS	Type of service byte
Destination AS	Autonomous system of the destination IP address (peer or origin)
Destination interface	SNMP index of the output interface
Reserved	Zero field

NetFlow Prefix Aggregation Scheme

The NetFlow prefix aggregation scheme generates data so that you can examine the sources and destinations of network traffic passing through a NetFlow-enabled device. The scheme groups data flows that have the same source prefix, destination prefix, source prefix mask, destination prefix mask, source BGP AS, destination BGP AS, input interface, and output interface. See Figure 6.

The aggregated NetFlow data export records report the following:

•Source and destination prefix

•Source and destination prefix mask

•Source and destination BGP AS

•Number of flows summarized by the aggregated record

•Number of bytes summarized by the aggregated record

•Number of packets summarized by the aggregated record

•Input and output interfaces

•Time stamp when the first packet is switched and time stamp when the last packet is switched

Figure 6 shows the data export format for the prefix aggregation scheme. For a definition of the data export terms used in the aggregation scheme, see Table 7.

Figure 6 Data Export Format for Prefix Aggregation Scheme

Table 7 lists definitions for the data export record terms used in the prefix aggregation scheme.

Table 7 Data Export Record Terms and Definitions for Prefix Aggregation Scheme 

Term	Definition
Flows	Number of main cache flows that were aggregated
Packets	Number of packets in the aggregated flows
Bytes	Number of bytes in the aggregated flows
First time stamp	System uptime when the first packet was switched
Last time stamp	System uptime when the last packet was switched
Source prefix	Source IP address ANDed with the source prefix mask, or the prefix to which the source IP address of the aggregated flows belongs
Destination prefix	Destination IP address ANDed with the destination prefix mask
Destination mask bits	Number of bits in the destination prefix
Source mask bits	Number of bits in the source prefix
Reserved	Zero field
Source AS	Autonomous system of the source IP address (peer or origin)
Destination AS	Autonomous system of the destination IP address (peer or origin)
Source interface	SNMP index of the input interface
Destination interface	SNMP index of the output interface

NetFlow Prefix-Port Aggregation Scheme

The NetFlow prefix-port aggregation scheme groups flows that have a common source prefix, source mask, destination prefix, destination mask, source port and destination port when applicable, input interface, output interface, protocol, and ToS byte. The aggregated NetFlow export record reports the following:

•Source prefix

•Source prefix mask

•Destination prefix

•Destination prefix mask

•Source port

•Destination port

•Source interface

•Destination interface

•Protocol

•ToS byte

•Number of flows summarized by the aggregated record

•Number of bytes summarized by the aggregated record

•Number of packets summarized by the aggregation record

•Time stamp when the first packet was switched and time stamp when the last packet was switched

This aggregation scheme is particularly useful for capturing data with which you can examine the sources and destinations of network traffic passing through a NetFlow-enabled device. Figure 7 shows the data export record for the prefix-port aggregation scheme. For a definition of the data export terms used in the aggregation scheme, see Table 8.

Figure 7 Data Export Record for Prefix-Port Aggregation Scheme

Table 8 lists definitions for the data export record terms used in the prefix-port aggregation scheme.

Table 8 Data Export Record Term Definitions for Prefix-Port Aggregation Scheme 

Term	Definition
Flows	Number of main cache flows that were aggregated
Packets	Number of packets in the aggregated flows
Bytes	Number of bytes in the aggregated flows
First time stamp	System uptime when the first packet was switched
Last time stamp	System uptime when the last packet was switched
Source prefix	Source IP address ANDed with the source prefix mask, or the prefix to which the source IP address of the aggregated flows belongs
Destination prefix	Destination IP address ANDed with the destination prefix mask
Destination mask bits	Number of bits in the destination prefix
Source mask bits	Number of bits in the source prefix
ToS	Type of service byte
Protocol	IP protocol byte
Source port	Source UDP or TCP port number if applicable
Destination port	Destination User Datagram Protocol (UDP) or TCP port number
Source interface	SNMP index of the input interface
Destination interface	SNMP index of the output interface

NetFlow Prefix-ToS Aggregation Scheme

The NetFlow prefix-tos aggregation scheme groups together flows that have a common source prefix, source mask, destination prefix, destination mask, source BGP AS, destination BGP AS, input interface, output interface, and ToS byte. The aggregated NetFlow export record reports the following:

•Source prefix

•Source prefix mask

•Destination prefix

•Destination prefix mask

•Source AS

•Destination AS

•Source interface

•Destination interface

•ToS byte

•Number of flows summarized by the aggregated record

•Number of bytes summarized by the aggregated record

•Number of packets summarized by the aggregated record

•Time stamp when the first packet was switched and time stamp when the last packet was switched

This aggregation scheme is particularly useful for capturing data so that you can examine the sources and destinations of network traffic passing through a NetFlow-enabled device. Figure 8 displays the data export format for the prefix-tos aggregation scheme. For a definition of the data export terms used in the aggregation scheme, see Table 9.

Figure 8 Data Export Format for Prefix-ToS Aggregation Scheme

Table 9 lists definitions for the data export record terms used in the prefix-ToS aggregation scheme.

Table 9 Data Export Record Term Definitions for Prefix-ToS Aggregation Scheme 

Term	Definition
Flows	Number of main cache flows that were aggregated
Packets	Number of packets in the aggregated flows
Bytes	Number of bytes in the aggregated flows
First time stamp	System uptime when the first packet was switched
Last time stamp	System uptime when the last packet was switched
Source prefix	Source IP address ANDed with the source prefix mask, or the prefix to which the source IP address of the aggregated flows belongs
Destination prefix	Destination IP address ANDed with the destination prefix mask
Destination mask bits	Number of bits in the destination prefix
Source mask bits	Number of bits in the source prefix
ToS	Type of service byte
Pad	Zero field
Source AS	Autonomous system of the source IP address (peer or origin)
Destination AS	Autonomous system of the destination IP address (peer or origin)
Source interface	SNMP index of the input interface
Destination interface	SNMP index of the output interface

NetFlow Protocol Port Aggregation Scheme

The NetFlow protocol port aggregation scheme captures data so that you can examine network usage by traffic type. The scheme groups data flows with the same IP protocol, source port number, and (when applicable) destination port number.

The aggregated NetFlow data export records report the following:

•Source and destination port numbers

•IP protocol (where 6 = TCP, 17 = UDP, and so on)

•Number of flows summarized by the aggregated record

•Number of bytes summarized by the aggregated record

•Number of packets summarized by the aggregated record

•Time stamp when the first packet was switched and time stamp when the last packet was switched

Figure 9 shows the data export format for the protocol port aggregation scheme. For a definition of the data export terms used in the aggregation scheme, see Table 10.

Figure 9 Data Export Format for Protocol Port Aggregation Scheme

Table 10 lists definitions for the data export record terms used in the protocol port aggregation scheme.

Table 10 Data Export Record Term Definitions for Protocol Port Aggregation Scheme 

Term	Definition
Flows	Number of main cache flows that were aggregated
Packets	Number of packets in the aggregated flows
Bytes	Number of bytes in the aggregated flows
First time stamp	System uptime when the first packet was switched
Last time stamp	System uptime when the last packet was switched
Protocol	IP protocol byte
PAD	Zero field
Reserved	Zero field
Source port	Source UDP or TCP port number if applicable
Destination port	Destination User Datagram Protocol (UDP) or TCP port number

NetFlow Protocol-Port-ToS Aggregation Scheme

The NetFlow protocol-port-tos aggregation scheme groups flows that have a common IP protocol, ToS byte, source and (when applicable) destination port numbers, and source and destination interfaces. The aggregated NetFlow Export record reports the following:

•Source application port number

•Destination port number

•Source and destination interface

•IP protocol

•ToS byte

•Number of flows summarized by the aggregated record

•Number of bytes summarized by the aggregated record

•Number of packets summarized by the aggregation record

•Time stamp when the first packet was switched and time stamp when the last packet was switched

This aggregation scheme is particularly useful for capturing data so that you can examine network usage by type of traffic. Figure 10 shows the data export format for the protocol-port-tos aggregation scheme. For a definition of the data export terms used in the aggregation scheme, see Table 11.

Figure 10 Data Export Format for Protocol-Port-ToS Aggregation Scheme

Table 11 lists definitions for the data export record terms used in the protocol-port-ToS aggregation scheme.

Table 11 Data Export Record Term Definitions for Protocol-Port-ToS Aggregation Scheme 

Term	Definition
Flows	Number of main cache flows that were aggregated
Packets	Number of packets in the aggregated flows
Bytes	Number of bytes in the aggregated flows
First time stamp	System uptime when the first packet was switched
Last time stamp	System uptime when the last packet was switched
Protocol	IP protocol byte
ToS	Type of service byte
Reserved	Zero field
Source port	Source UDP or TCP port number if applicable
Destination port	Destination User Datagram Protocol (UDP) or TCP port number
Source interface	SNMP index of the input interface
Destination interface	SNMP index of the output interface

NetFlow Source Prefix Aggregation Scheme

The NetFlow source prefix aggregation scheme captures data so that you can examine the sources of network traffic passing through a NetFlow-enabled device. The scheme groups data flows that have the same source prefix, source prefix mask, source BGP AS, and input interface.

The aggregated NetFlow data export records report the following:

•Source prefix

•Source prefix mask

•Source BGP AS

•Number of bytes summarized by the aggregated record

•Number of packets summarized by the aggregated record

•Input interface

•Time stamp when the first packet was switched and time stamp when the last packet was switched

Figure 11 show the data export format for the source prefix aggregation scheme. For a definition of the data export terms used in the aggregation scheme, see Table 12.

Figure 11 Data Export Format for Source Prefix Aggregation Scheme

Table 12 lists definitions for the data export record terms used in the source prefix aggregation scheme.

Table 12 Data Export Record Term Definitions for Source Prefix Aggregation Scheme 

Term	Definition
Flows	Number of main cache flows that were aggregated
Packets	Number of packets in the aggregated flows
Bytes	Number of bytes in the aggregated flows
First time stamp	System uptime when the first packet was switched
Last time stamp	System uptime when the last packet was switched
Source prefix	Source IP address ANDed with the source prefix mask, or the prefix to which the source IP address of the aggregated flows belongs
Source mask bits	Number of bits in the source prefix
PAD	Zero field
Source AS	Autonomous system of the source IP address (peer or origin)
Source interface	SNMP index of the input interface
Reserved	Zero field

NetFlow Source Prefix-ToS Aggregation Scheme

The NetFlow source prefix-ToS aggregation scheme groups flows that have a common source prefix, source prefix mask, source BGP AS, ToS byte, and input interface. The aggregated NetFlow export record reports the following:

•Source prefix

•Source prefix mask

•Source AS

•ToS byte

•Number of bytes summarized by the aggregated record

•Number of packets summarized by the aggregation record

•Input interface

•Time stamp when the first packet was switched and time stamp when the last packet was switched

This aggregation scheme is particularly useful for capturing data so that you can examine the sources of network traffic passing through a NetFlow-enabled device. Figure 12 show the data export format for the source prefix-ToS aggregation scheme. For a definition of the data export terms used in the aggregation scheme, see Table 13.

---

Note When a router does not have a prefix for the source IP address in the flow, NetFlow uses 0.0.0.0 with 0 mask bits rather than making /32 entries. This prevents DOS attacks that use random source addresses from thrashing the aggregation caches. This is also done for the destination in the destination prefix-ToS, the prefix-ToS, and prefix-port aggregation schemes.

---

Figure 12 Data Export Format for Source Prefix-ToS Aggregation Scheme

Table 13 lists definitions for the data export record terms used in the source prefix-ToS aggregation scheme.

Table 13 Data Export Record Term Definitions for Source Prefix-ToS Aggregation Scheme 

Term	Definition
Flows	Number of main cache flows that were aggregated
Packets	Number of packets in the aggregated flows
Bytes	Number of bytes in the aggregated flows
First time stamp	System uptime when the first packet was switched
Last time stamp	System uptime when the last packet was switched
Source prefix	Source IP address ANDed with the source prefix mask, or the prefix to which the source IP address of the aggregated flows belongs
Source mask bits	Number of bits in the source prefix
ToS	Type of service byte
Source AS	Autonomous system of the source IP address (peer or origin)
Source interface	SNMP index of the input interface
Reserved	Zero field

NetFlow Data Export Format Versions 9, and 8 for NetFlow Aggregation Caches: Overview

Export formats available for NetFlow aggregation caches are the Version 9 export format and the Version 8 export format.

•Version 9—A flexible and extensible format, which provides the versatility needed for support of new fields and record types. This format accommodates new NetFlow-supported technologies such as Multicast, Multiprotocol Label Switching (MPLS), and Border Gateway Protocol (BGP) next hop. Version 9 export format enables you to use the same version for main and aggregation caches, and the format is extendable, so you can use the same export format with future features.

•Version 8—A format added to support data export from aggregation caches. Export datagrams contain a subset of the usual Version 5 export data, which is valid for the particular aggregation cache scheme. Version 8 is the default export version for aggregation caches when data export is configured.

The Version 9 export format is flexible and extensible, which provides the versatility needed for the support of new fields and record types. You can use the Version 9 export format for both main and aggregation caches.

The Version 8 export format was added to support data export from aggregation caches. This format allows export datagrams to contain a subset of the Version 5 export data that is valid for the cache aggregation scheme.

Refer to the "NetFlow Data Export" section of the "Configuring NetFlow Aggregation Caches" module for more details on NetFlow Data Export Formats.

How to Configure NetFlow Aggregation Caches

This section is broken down into the following subsections:

•Configuring NetFlow Aggregation Caches (required)

•Verifying the Aggregation Cache Configuration (optional)

Configuring NetFlow Aggregation Caches

Perform the steps in this required to enable NetFlow and configure a NetFlow aggregation cache.

SUMMARY STEPS

1. enable

2. configure terminal

3. ip flow-aggregation cache {as | as-tos | bgp-nexthop-tos | destination-prefix | destination-prefix-tos | prefix | prefix-port | prefix-tos | protocol-port | protocol-port-tos | source-prefix | source-prefix-tos}

4. cache entries number

5. cache timeout active minutes

6. cache timeout inactive seconds

7. export destination {{ip-address | hostname} udp-port}

8. Repeat Step 7 once to configure a second export destination

9. export version [9 | 8]

10. enabled

11. exit

12. <