 Feedback
|
Table Of Contents
Configuring NetFlow and NetFlow Data Export
Prerequisites for Configuring NetFlow and NetFlow Data Export
Restrictions for Configuring NetFlow and NetFlow Data Export
Information About Configuring NetFlow and NetFlow Data Export
NetFlow Cache Management and Data Export
NetFlow Export Format Versions 9, 8, and 5
Overview of NetFlow Export Format Versions 9, 8, and 5
NetFlow Export Version Formats
NetFlow Export Packet Header Format
NetFlow Flow Record and Export Format Content Information
NetFlow Data Export Format Selection
NetFlow Version 9 Data Export Format
NetFlow Version 8 Data Export Format
NetFlow Version 5 Data Export Format
Egress NetFlow Accounting Benefits: NetFlow Accounting Simplified
NetFlow Subinterface Support Benefits: Fine-Tuning Your Data Collection
NetFlow Multiple Export Destinations: Benefits
How to Configure NetFlow and NetFlow Data Export
Verifying That NetFlow Is Operational and Viewing NetFlow Statistics
Configuring NetFlow Data Export Using the Version 9 Export Format
Verifying That NetFlow Data Export Is Operational
Clearing NetFlow Statistics on the Router
Customizing the NetFlow Main Cache Parameters
NetFlow Cache Entry Management on a Routing Device
Configuration Examples for NetFlow and NetFlow Data Export
Example: Configuring Egress NetFlow Accounting
Example: Configuring NetFlow Subinterface Support
Example: NetFlow Subinterface Support for Ingress (Received) Traffic on a Subinterface
Example: NetFlow SubInterface Support for Egress (Transmitted) Traffic on a Subinterface
Example: Configuring NetFlow Multiple Export Destinations
Example: Configuring NetFlow Version 5 Data Export
Feature Information for Configuring NetFlow and NetFlow Data Export
Configuring NetFlow and NetFlow Data Export
First Published: June 19, 2006Last Updated: April 15, 2011This module contains information about and instructions for configuring NetFlow to capture and export network traffic data. NetFlow capture and export are performed independently on each internetworking device on which NetFlow is enabled. NetFlow need not be operational on each router in the network. NetFlow is a Cisco IOS XE application that provides statistics on packets flowing through the router. NetFlow is emerging as a primary network accounting and security technology.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Configuring NetFlow and NetFlow Data Export" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•
Prerequisites for Configuring NetFlow and NetFlow Data Export
•
•
•
•
•
Prerequisites for Configuring NetFlow and NetFlow Data Export
•
•
•
Restrictions for Configuring NetFlow and NetFlow Data Export
Preset Size of NetFlow Cache
NetFlow consumes additional memory. If you have memory constraints, you might want to preset the size of the NetFlow cache so that it contains a smaller number of entries. The default cache size depends on the platform.
Egress NetFlow Accounting in Cisco IOS XE Release 2.1 or Later Releases
The Egress NetFlow Accounting feature captures NetFlow statistics for IP traffic only. Multiprotocol Label Switching (MPLS) statistics are not captured. The Egress NetFlow Accounting feature can be used on a provider edge (PE) router to capture IP traffic flow information for egress IP packets that arrived at the router as MPLS packets and underwent label disposition.
Egress NetFlow accounting might adversely affect network performance because of the additional accounting-related computation that occurs in the traffic-forwarding path of the router.
Locally generated traffic (traffic that is generated by the router on which the Egress NetFlow Accounting feature is configured) is not counted as flow traffic for the Egress NetFlow Accounting feature.
Note
Restrictions for NetFlow Version 9 Data Export
•
•
•
Restrictions for NetFlow Version 8 Export Format
Version 8 export format is available only for aggregation caches, and it cannot be expanded to support new features.
Restrictions for NetFlow Version 5 Export Format
Version 5 export format is suitable only for the main cache, and it cannot be expanded to support new features.
Policy-Based Routing and NetFlow Data Export
If a local policy is configured, an Aggregation Services Router (ASR) checks the injected packet and applies policy-based routing (PBR) to the packet. When NetFlow Data Export (NDE) packets are injected in the data path during Cisco Express Forwarding lookup, the PBR local policy is not applied to the NDE packets. Therefore, NDE features on ASR cannot work with PBR.
Information About Configuring NetFlow and NetFlow Data Export
•
•
•
•
•
NetFlow Data Capture
NetFlow captures data from ingress (incoming) and egress (outgoing) packets. NetFlow gathers statistics for the following ingress IP packets:
•
•
•
•
NetFlow captures data for all egress (outgoing) packets through the use of the following feature:
•
NetFlow Flows: Key Fields
A network flow is identified as a unidirectional stream of packets between a given source and destination—both are defined by a network-layer IP address and by transport-layer source and destination port numbers. Specifically, a flow is identified as the combination of the following key fields:
•
•
•
•
•
•
•
These seven key fields define a unique flow. If a packet has one key field different from another packet, it is considered to belong to another flow. A flow might contain other accounting fields (such as the autonomous system (AS) number in the NetFlow export Version 5 flow format) that depend on the export record version that you configure. Flows are stored in the NetFlow cache.
NetFlow Cache Management and Data Export
The key components of NetFlow are the NetFlow cache or data source that stores IP flow information, and the NetFlow export or transport mechanism that sends NetFlow data to a network management collector, such as the NetFlow Collection Engine. NetFlow operates by creating a NetFlow cache entry (a flow record) for each active flow. A flow record is maintained within the NetFlow cache for each active flows. Each flow record in the NetFlow cache contains fields that can later be exported to a collection device, such as the NetFlow Collection Engine.
NetFlow is very efficient with the amount of export data being about 1.5 percent of the switched traffic in the router. NetFlow accounts for every packet (non-sampled mode) and provides a highly condensed and detailed view of all network traffic that entered the router or switch.
The key to NetFlow-enabled switching scalability and performance is highly intelligent flow cache management, especially for densely populated and busy edge routers handling large numbers of concurrent, short duration flows. The NetFlow cache management software contains a highly sophisticated set of algorithms for efficiently determining if a packet is part of an existing flow or should generate a new flow cache entry. The algorithms are also capable of dynamically updating the per-flow accounting measurements that reside in the NetFlow cache, and determining cache aging/flow expiration.
Rules for expiring NetFlow cache entries include:
•
•
•
Expired flows are grouped together into "NetFlow export" datagrams for export from the NetFlow- enabled device. The NetFlow functionality is configured on a per-interface basis. To configure NetFlow export capabilities, you need to specify the IP address and application port number of the Cisco NetFlow or third-party flow collector. The flow collector is a device that provides NetFlow export data filtering and aggregation capabilities. Figure 1 shows an example of NetFlow data export from the main and aggregation caches to a collector.
Figure 1 NetFlow Data Export from the Main and Aggregation Caches
NetFlow Export Format Versions 9, 8, and 5
The following sections provide more detailed information on NetFlow Data Export Formats Versions 9, 8, and 5:
•
•
•
•
•
•
•
•
Overview of NetFlow Export Format Versions 9, 8, and 5
NetFlow exports data in UDP datagrams in one of the following formats: Version 9, Version 8, Version 7, or Version 5.
•
•
•
NetFlow Export Version Formats
For all export versions, the NetFlow export datagram consists of a header and a sequence of flow records. The header contains information such as the sequence number, record count, and system uptime. The flow record contains flow information, for example, IP addresses, ports, and routing information.
The NetFlow Version 9 export format is the newest NetFlow export format. The distinguishing feature of the NetFlow Version 9 export format is that it is template based. Templates make the record format extensible. This feature allows future enhancements to NetFlow without requiring concurrent changes to the basic flow-record format.
The use of templates with the NetFlow Version 9 export format provides several other key benefits:
•
•
•
The work of the IETF IP Information Export (IPFIX) Working Group (WG) and the IETF Pack Sampling (PSAMP) WG are based on the NetFlow Version 9 export format.
The Version 5 export format adds BGP autonomous system information and flow sequence numbers. the Version 8 export format is the NetFlow export format to use when you enable router-based NetFlow aggregation on Cisco IOS XE router platforms.
Figure 2 shows a typical datagram used for NetFlow fixed format export Versions 5, 7, and 8.
Figure 2 Typical Datagram for NetFlow Fixed Format Export Versions 5, 7, and 8
NetFlow Export Packet Header Format
In all five export versions, the datagram consists of a header and one or more flow records. The first field of the header contains the version number of the export datagram. Typically, a receiving application that accepts any of the format versions allocates a buffer large enough for the largest possible datagram from any of the format versions, and then uses the header to determine how to interpret the datagram. The second field in the header contains the number of records in the datagram (indicating the number of expired flows represented by this datagram). Datagram headers for NetFlow Export Versions 5, 8, and 9 also include a "sequence number" field used by NetFlow collectors to check for lost datagrams.
The NetFlow Version 9 export packet header format is shown in Figure 3.
Figure 3 NetFlow Version 9 Export Packet Header Format
Table 1 lists the NetFlow Version 9 export packet header field names and descriptions.
NetFlow Flow Record and Export Format Content Information
This section gives details about the Cisco export format flow record. Table 2 indicates which flow record format fields are available for Version 5, and 9. (Y indicates that the field is available. N indicates that the field is not available.)
Table 2 NetFlow Flow Record Format Fields for Format Versions 5 and 9
source IP address
Y
Y
destination IP address
Y
Y
source TCP/UDP application port
Y
Y
destination TCP/UDP application port
Y
Y
next hop router IP address
Y
Y
input physical interface index
Y
Y
output physical interface index
Y
Y
packet count for this flow
Y
Y
byte count for this flow
Y
Y
start of flow timestamp
Y
Y
end of flow timestamp
Y
Y
IP Protocol (for example, TCP=6; UDP=17)
Y
Y
Type of Service (ToS) byte
Y
Y
TCP Flags (cumulative OR of TCP flags)
Y
Y
source AS number
Y
Y
destination AS number
Y
Y
source subnet mask
Y
Y
destination subnet mask
Y
Y
flags (indicates, among other things, which flows are invalid)
Y
Y
Other flow fields1
N
Y
1 For a list of other flow fields available in Version 9 export format, see Figure 5.
Figure 4 is an example of the NetFlow Version 5 export record format, including the contents and description of byte locations. The terms in bold indicate values that were added for the Version 5 format.
Figure 4 NetFlow Version 5 Export Record Format
Table 3 shows the field names and descriptions for the NetFlow Version 5 export record format.
Figure 5 shows a typical flow record for the Version 9 export format. The NetFlow Version 9 export record format is different from the traditional NetFlow fixed format export record. In NetFlow Version 9, a template describes the NetFlow data and the flow set contains the actual data. This allows for flexible export. Detailed information about the fields currently in Version 9 and the export format architecture are available in the NetFlow Version 9 Flow-Record Format document.
Figure 5 NetFlow Version 9 Export Packet Example
For all export versions, you specify a destination where NetFlow data export packets are sent, such as the workstation running NetFlow Collection Engine, either when the number of recently expired flows reaches a predetermined maximum, or every second—whichever occurs first. For a Version 5 datagram, up to 30 flows can be sent in a single UDP datagram of approximately 1500 bytes.
For detailed information on the flow record formats, data types, and export data fields for Version 9 and platform-specific information when applicable, see Appendix 2 in the NetFlow Solutions Service Guide.
NetFlow Data Export Format Selection
NetFlow exports data in UDP datagrams in export format Version 9, 8, or 5. Table 4 describes situations when you might select a particular NetFlow export format.
NetFlow Version 9 Data Export Format
NetFlow Version 9 data export supports Cisco Express Forwarding switching and fast switching.
NetFlow Version 9 is a flexible and extensible means for transferring NetFlow records from a network node to a collector. NetFlow Version 9 has definable record types and is self-describing for easier NetFlow Collection Engine configuration.
Using Version 9 export, you define new formats on the router that you can send to the NetFlow Collection Engine (formerly called NetFlow FlowCollector) at set intervals. You enable the features that you want, and the field values corresponding to those features are sent to the NetFlow Collection Engine.
Third-party business partners, who produce applications that provide NetFlow Collection Engine or display services for NetFlow need not recompile their applications each time a new NetFlow technology is added. Instead, with the NetFlow v9 Export Format feature, they can use an external data file that documents the known template formats and field types.
In NetFlow Version 9:
•
•
•
•
NetFlow Version 9 Template-Based Flow Record Format
The main feature of the NetFlow Version 9 export format is that it is template based. A template describes a NetFlow record format and attributes of the fields (such as type and length) within the record. The router assigns each template an ID, which is communicated to the NetFlow Collection Engine, along with the template description. The template ID is used for all further communication from the router to the NetFlow Collection Engine.
NetFlow Version 9 Export Flow Records
The basic output of NetFlow is a flow record. In the NetFlow Version 9 export format, a flow record follows the same sequence of fields as found in the template definition. The template to which NetFlow flow records belong is determined by the prefixing of the template ID to the group of NetFlow flow records that belong to a template. For a complete discussion of existing NetFlow flow-record formats, see the NetFlow Services Solutions Guide.
NetFlow Version 9 Export Packet
In NetFlow Version 9, an export packet consists of the packet header and flowsets. The packet header identifies the new version and provides other information. See Figure 3 for Version 9 export packet header details. Flowsets are of two types: template flowsets and data flowsets. The template flowset describes the fields that will be in the data flowsets (or flow records). Each data flowset contains the values or statistics of one or more flows with the same template ID. When the NetFlow Collection Engine receives a template flowset, it stores the flowset and export source address so that subsequent data flowsets that match the flowset ID and source combination are parsed according to the field definitions in the template flowset. Version 9 supports NetFlow Collection Engine Version 4.0. For an example of a Version 9 export packet, see Figure 5.
NetFlow Version 8 Data Export Format
The Version 8 data export format is the NetFlow export format used when the router-based NetFlow aggregation feature is enabled on Cisco IOS XE router platforms. The Version 8 format allows for export datagrams to contain a subset of the Version 5 export data that is based on the configured aggregation cache scheme. For example, a certain subset of the Version 5 export data is exported for the destination prefix aggregation scheme, and a different subset is exported for the source-prefix aggregation scheme.
The Version 8 export format was introduced in the Cisco IOS NetFlow Aggregation feature. An additional six aggregation schemes that also use Version 8 format were defined for the NetFlow ToS-Based Router Aggregation feature. Refer to the Configuring NetFlow Aggregation Caches module for information about configuring Version 8 data export for aggregation caches.
The Version 8 datagram consists of a header with the version number (which is 8) and time stamp information, followed by one or more records corresponding to individual entries in the NetFlow cache.
Figure 6 displays the NetFlow Version 8 export packet header format.
Figure 6 NetFlow Version 8 Export Packet Header Format
Table 5 lists the NetFlow Version 8 export packet header field names and definitions.
NetFlow Version 5 Data Export Format
The Version 5 data export format adds support for BGP autonomous system information and flow sequence numbers.
Because NetFlow uses UDP to send export datagrams, datagrams can be lost. The Version 5 header format contains a flow sequence number to find out whether flow export information has been lost. The sequence number is equal to the sequence number of the previous datagram plus the number of flows in the previous datagram. After receiving a new datagram, the receiving application can subtract the expected sequence number from the sequence number in the header to get the number of missed flows.
All fields in Version 5 export format are in network byte order. Figure 7 shows the NetFlow Version 5 export packet header format.
Figure 7 NetFlow Version 5 Export Packet Header Format
Table 6 lists the NetFlow Version 5 export packet header field names and descriptions.
Table 7 lists the byte definitions for the Version 5 flow record format.
Egress NetFlow Accounting Benefits: NetFlow Accounting Simplified
The Egress NetFlow Accounting feature can simplify NetFlow configuration, which is illustrated in the following example.
In Figure 8 and Figure 9, both incoming and outgoing (ingress and egress) flow statistics are required for the server. The server is attached to Router B. The "cloud" in the figure represents the core of the network and includes MPLS VPNs.
All traffic denoted by the arrows must be accounted for. The solid arrows represent IP traffic and the dotted arrows represent MPLS VPNs.
Figure 8 shows how the flow traffic was tracked before the introduction of the Egress NetFlow Accounting feature. Figure 9 shows how the flow traffic is tracked after the introduction of the Egress NetFlow Accounting feature. The Egress NetFlow Accounting feature simplifies configuration tasks and makes it easier for you to collect and track incoming and outgoing flow statistics for the server in this example.
Because only ingress flows could be tracked before the Egress NetFlow Accounting feature was introduced, the following NetFlow configurations had to be implemented for the tracking of ingress and egress flows from Router B:
•
•
•
•
Figure 8 Ingress-Only NetFlow Example
A configuration such as the one used in Figure 8 requires that NetFlow statistics from three separate routers be added together to obtain the flow statistics for the server.
In comparison, the example in Figure 9 shows NetFlow, the Egress NetFlow Accounting feature, and the MPLS Egress NetFlow Accounting feature being used to capture ingress and egress flow statistics for Router B, thus obtaining the required flow statistics for the server.
In Figure 9, the following NetFlow configurations are applied to Router B:
•
•
•
•
After NetFlow is configured on Router B, you can display all NetFlow statistics for the server by entering the show ip cache flow command or the show ip cache verbose flow command for Router B.
Figure 9 Egress NetFlow Accounting Example
.
NetFlow Subinterface Support Benefits: Fine-Tuning Your Data Collection
You can configure NetFlow on a per-subinterface basis. If your network contains thousands of subinterfaces and you want to collect export records from only a few subinterfaces, you can do that. The result is lower bandwidth requirements for NetFlow data export and reduced platform requirements for NetFlow data-collection devices.
The configuration of NetFlow on selected subinterfaces provides the following benefits:
•
•
NetFlow Multiple Export Destinations: Benefits
The NetFlow Multiple Export Destinations feature enables configuration of multiple destinations for the NetFlow data. With this feature enabled, two identical streams of NetFlow data are sent to the destination host. Currently, the maximum number of export destinations allowed is two.
The NetFlow Multiple Export Destinations feature improves the chances of receiving complete NetFlow data because it provides redundant streams of data. Because the same export data is sent to more than one NetFlow collector, fewer packets are lost.
How to Configure NetFlow and NetFlow Data Export
•
•
•
•
•
•
Configuring NetFlow
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Step 1
enable
Example:Router> enable
(Required) Enables privileged EXEC mode.
•
Step 2
configure terminal
Example:Router# configure terminal
(Required) Enters global configuration mode.
Step 3
interface interface-type interface-number
Example:Router(config)# interface fastethernet 0/0/0
(Required) Specifies the interface that you want to enable NetFlow on and enters interface configuration mode.
Step 4
ip flow {ingress | egress}
Example:Router(config-if)# ip flow ingress
(Required) Enables NetFlow on the interface.
•
•
This is the Egress NetFlow Accounting feature that is described in the "Egress NetFlow Accounting Benefits: NetFlow Accounting Simplified" section.
Step 5
exit
Example:Router(config-if)# exit
(Optional) Exits interface configuration mode and returns to global configuration mode.
Note
Step 6
Repeat Steps 3 through 5 to enable NetFlow on other interfaces
(Optional) —
Step 7
end
Example:Router(config-if)# end
(Required) Exits the current configuration mode and returns to privileged EXEC mode.
Verifying That NetFlow Is Operational and Viewing NetFlow Statistics
To verify that NetFlow is operational and to view the NetFlow statistics, perform the following steps.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Step 1
Use this command to enable privileged EXEC mode. Enter your password if prompted.
Router> enableRouter#
Step 2
Use this command to verify that NetFlow is operational and to display a summary of the NetFlow statistics. The following is sample output from this command:
Router# show ip cache flowIP packet size distribution (1103746 total packets):1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480.249 .694 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000512 544 576 1024 1536 2048 2560 3072 3584 4096 4608.000 .000 .027 .000 .027 .000 .000 .000 .000 .000 .000IP Flow Switching Cache, 278544 bytes35 active, 4061 inactive, 980 added2921778 ager polls, 0 flow alloc failuresActive flows timeout in 30 minutesInactive flows timeout in 15 secondsIP Sub Flow Cache, 21640 bytes0 active, 1024 inactive, 0 added, 0 added to flow0 alloc failures, 0 force free1 chunk, 1 chunk addedlast clearing of statistics neverProtocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)-------- Flows /Sec /Flow /Pkt /Sec /Flow /FlowTCP-FTP 108 0.0 1133 40 2.4 1799.6 0.9TCP-FTPD 108 0.0 1133 40 2.4 1799.6 0.9TCP-WWW 54 0.0 1133 40 1.2 1799.6 0.8TCP-SMTP 54 0.0 1133 40 1.2 1799.6 0.8TCP-BGP 27 0.0 1133 40 0.6 1799.6 0.7TCP-NNTP 27 0.0 1133 40 0.6 1799.6 0.7TCP-other 297 0.0 1133 40 6.8 1799.7 0.8UDP-TFTP 27 0.0 1133 28 0.6 1799.6 1.0UDP-other 108 0.0 1417 28 3.1 1799.6 0.9ICMP 135 0.0 1133 427 3.1 1799.6 0.8Total: 945 0.0 1166 91 22.4 1799.6 0.8SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP PktsFEt0/0/0 192.168.67.6 FEt1/0/0.1 172.16.10.200 01 0000 0C01 51FEt0/0/0 10.10.18.1 Null 172.16.11.5 11 0043 0043 51FEt0/0/0 10.10.18.1 Null 172.16.11.5 11 0045 0045 51FEt0/0/0 10.234.53.1 FEt1/0/0.1 172.16.10.2 01 0000 0800 51FEt0/0/0 10.10.19.1 Null 172.16.11.6 11 0044 0044 51FEt0/0/0 10.10.19.1 Null 172.16.11.6 11 00A2 00A2 51FEt0/0/0 192.168.87.200 FEt1/0/0.1 172.16.10.2 06 0014 0014 50FEt0/0/0 192.168.87.200 FEt1/0/0.1 172.16.10.2 06 0015 0015 52...FEt0/0/0 172.16.1.84 FEt1/0.1 172.16.10.19 06 0087 0087 50FEt0/0/0 172.16.1.84 FEt1/0.1 172.16.10.19 06 0050 0050 51FEt0/0/0 172.16.1.85 FEt1/0.1 172.16.10.20 06 0089 0089 49FEt0/0/0 172.16.1.85 FEt1/0.1 172.16.10.20 06 0050 0050 50FEt0/0/0 10.251.10.1 FEt1/0.1 172.16.10.2 01 0000 0800 51FEt0/0/0 10.162.37.71 Null 172.16.11.3 06 027C 027C 49Router#Step 3
Use this command to verify that NetFlow is operational and to display a detailed summary of the NetFlow statistics. The following is sample output from this command:
Router# show ip cache verbose flowToSIP packet size distribution (1130681 total packets):1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480.249 .694 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000512 544 576 1024 1536 2048 2560 3072 3584 4096 4608.000 .000 .027 .000 .027 .000 .000 .000 .000 .000 .000IP Flow Switching Cache, 278544 bytes35 active, 4061 inactive, 980 added2992518 ager polls, 0 flow alloc failuresActive flows timeout in 30 minutesInactive flows timeout in 15 secondsIP Sub Flow Cache, 21640 bytes0 active, 1024 inactive, 0 added, 0 added to flow0 alloc failures, 0 force free1 chunk, 1 chunk addedlast clearing of statistics neverProtocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)-------- Flows /Sec /Flow /Pkt /Sec /Flow /FlowTCP-FTP 108 0.0 1133 40 2.4 1799.6 0.9TCP-FTPD 108 0.0 1133 40 2.4 1799.6 0.9TCP-WWW 54 0.0 1133 40 1.2 1799.6 0.8TCP-SMTP 54 0.0 1133 40 1.2 1799.6 0.8TCP-BGP 27 0.0 1133 40 0.6 1799.6 0.7TCP-NNTP 27 0.0 1133 40 0.6 1799.6 0.7TCP-other 297 0.0 1133 40 6.6 1799.7 0.8UDP-TFTP 27 0.0 1133 28 0.6 1799.6 1.0UDP-other 108 0.0 1417 28 3.0 1799.6 0.9ICMP 135 0.0 1133 427 3.0 1799.6 0.8Total: 945 0.0 1166 91 21.9 1799.6 0.8SrcIf SrcIPaddress DstIf DstIPaddress Pr TOS Flgs PktsPort Msk AS Port Msk AS NextHop B/Pk ActiveFEt0/0/0 192.168.67.6 FEt1/0.1 172.16.10.200 01 00 10 7990000 /0 0 0C01 /0 0 0.0.0.0 28 1258.1FEt0/0/0 10.10.18.1 Null 172.16.11.5 11 00 10 7990043 /0 0 0043 /0 0 0.0.0.0 28 1258.0FEt0/0/0 10.10.18.1 Null 172.16.11.5 11 00 10 7990045 /0 0 0045 /0 0 0.0.0.0 28 1258.0FEt0/0/0 10.234.53.1 FEt1/0.1 172.16.10.2 01 00 10 7990000 /0 0 0800 /0 0 0.0.0.0 28 1258.1FEt0/0/0 10.10.19.1 Null 172.16.11.6 11 00 10 7990044 /0 0 0044 /0 0 0.0.0.0 28 1258.1...FEt0/0/0 172.16.1.84 FEt1/0/0.1 172.16.10.19 06 00 00 7990087 /0 0 0087 /0 0 0.0.0.0 40 1258.1FEt0/0/0 172.16.1.84 FEt1/0/0.1 172.16.10.19 06 00 00 7990050 /0 0 0050 /0 0 0.0.0.0 40 1258.0FEt0/0/0 172.16.1.85 FEt1/0/0.1 172.16.10.20 06 00 00 7980089 /0 0 0089 /0 0 0.0.0.0 40 1256.5FEt0/0/0 172.16.1.85 FEt1/0/0.1 172.16.10.20 06 00 00 7990050 /0 0 0050 /0 0 0.0.0.0 40 1258.0FEt0/0/0 10.251.10.1 FEt1/0/0.1 172.16.10.2 01 00 10 7990000 /0 0 0800 /0 0 0.0.0.0 1500 1258.1FEt0/0/0 10.162.37.71 Null 172.16.11.3 06 00 00 798027C /0 0 027C /0 0 0.0.0.0 40 1256.4Router#Step 4
Use this command to exit privileged EXEC mode.
Router# end
Configuring NetFlow Data Export Using the Version 9 Export Format
Prerequisites
This task does not include the steps for configuring NetFlow. You must configure NetFlow by enabling it on at least one interface in the router in order to export traffic data with NetFlow Data Export. Refer to the "Configuring NetFlow" section for information about configuring NetFlow.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
DETAILED STEPS
Step 1
enable
Example:Router> enable
(Required) Enters privileged EXEC mode.
•
Step 2
configure terminal
Example:Router# configure terminal
(Required) Enters global configuration mode.
Step 3
ip flow-export destination {{ip-address | hostname} udp-port}
Example:Router(config)# ip flow-export destination 172.16.10.2 99
(Required) Specifies the IP address or hostname of the NetFlow collector, and the UDP port the NetFlow collector is listening on.
Step 4
Repeat Step 3 to configure a second NetFlow export destination, if desired.
(Optional) You can configure a maximum of two export destinations for NetFlow.
This is the NetFlow Multiple Export Destinations feature that is described in the "NetFlow Multiple Export Destinations: Benefits" section.
Step 5
ip flow-export source interface-type interface-number
Example:Router(config)# ip flow-export source fastethernet 0/0/0
(Optional) The IP address of the interface specified is used as the source IP address for the UDP datagrams that are sent by NetFlow data export to the destination host.
Note
Step 6
ip flow-export version 9 [origin-as | peer-as] [bgp-nexthop]
Example:Router(config)# ip flow-export version 9
(Optional) Enables the export of information in NetFlow cache entries.
•
•
•
•
Step 7
ip flow-export template refresh-rate packets
Example:Router(config)# ip flow-export template refresh-rate 15
(Optional) Enables the export of information in NetFlow cache entries.
•
•
Step 8
ip flow-export template timeout-rate minutes
Example:Router(config)# ip flow-export template timeout-rate 90
(Optional) Enables the export of information in NetFlow cache entries.
•
•
Step 9
ip flow-export template options export-stats
Example:Router(config)# ip flow-export template options export-stats
(Optional) Enables the export of information in NetFlow cache entries.
•
•
•
Step 10
ip flow-export template options refresh-rate packets
Example:Router(config)# ip flow-export template options refresh-rate 25
(Optional) Enables the export of information in NetFlow cache entries.
•
•
•
Step 11
ip flow-export template options timeout-rate minutes
Example:Router(config)# ip flow-export template options timeout-rate 120
(Optional) Enables the export of information in NetFlow cache entries.
•
•
•
Step 12
end
Example:Router(config)# end
(Required) Exits the current configuration mode and returns to privileged EXEC mode.
Verifying That NetFlow Data Export Is Operational
To verify that NetFlow data export is operational and to view the statistics for NetFlow data export, perform the following task.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Step 1
Use this command to enable privileged EXEC mode. Enter your password if prompted.
Router> enableRouter#
Step 2
Use this command to display the statistics for the NetFlow data export, including statistics for the main cache and for all other enabled caches. The following is sample output from this command:
Router# show ip flow exportFlow export v9 is enabled for main cacheExporting flows to 172.16.10.2 (99)Exporting using source interface FastEthernet0/0/0Version 9 flow records0 flows exported in 0 udp datagrams0 flows failed due to lack of export packet0 export packets were sent up to process level0 export packets were dropped due to no fib0 export packets were dropped due to adjacency issues0 export packets were dropped due to fragmentation failures0 export packets were dropped due to encapsulation fixup failuresRouter#Step 3
Use this command to display the statistics for the NetFlow data export (such as the template timeout rate and the refresh rate) for the template-specific configurations. The following is sample output from this command:
Router# show ip flow export templateTemplate Options Flag = 1Total number of Templates added = 1Total active Templates = 1Flow Templates active = 0Flow Templates added = 0Option Templates active = 1Option Templates added = 1Template ager polls = 0Option Template ager polls = 140Main cache version 9 export is enabledTemplate export informationTemplate timeout = 90Template refresh rate = 15Option export informationOption timeout = 120Option refresh rate = 25Router#Step 4
Use this command to exit privileged EXEC mode.
Router# end
Clearing NetFlow Statistics on the Router
To clear NetFlow statistics on the router, perform the following task.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
Step 1
Use this command to enable privileged EXEC mode. Enter your password if prompted.
Router> enableRouter#Step 2
Use this command to clear the NetFlow statistics on the router. For example:
Router# clear ip flow statsStep 3
Use this command to exit privileged EXEC mode.
Router# end
Customizing the NetFlow Main Cache Parameters
NetFlow operates by creating a NetFlow cache entry (a flow record) for each active flow. A flow record is maintained within the NetFlow cache for all active flows. Each flow record in the NetFlow cache contains fields that can later be exported to a collection device, such as the NetFlow Collection Engine. NetFlow enables the accumulation of data on flows. Each flow is identified by unique characteristics such as IP address, interface, application, and ToS.
To customize the parameters for the main NetFlow cache, perform the following steps.
NetFlow Cache Entry Management on a Routing Device
The routing device checks the NetFlow cache once per second and causes the flow to expire in the following instances:
•
•
•
Routing device default timer settings are 15 seconds for the inactive timer and 30 minutes for the active timer. You can configure your own time interval for the inactive timer between 10 and 600 seconds. You can configure the time interval for the active timer between 1 and 60 minutes.
NetFlow Cache Size
After you enable NetFlow on an interface, NetFlow reserves memory to accommodate a number of entries in the NetFlow cache. Normally, the size of the NetFlow cache meets the needs of your NetFlow traffic rates. The cache default size is 64K flow cache entries. Each cache entry requires 64 bytes of storage. About 4 MB of DRAM are required for a cache with the default number of entries. You can increase or decrease the number of entries maintained in the cache, if required. For environments with a large amount of flow traffic (such as an Internet core router), we recommend a larger value such as 131072 (128K). To obtain information on your flow traffic, use the show ip cache flow command.
Using the ip flow-cache entries command, you can configure the size of your NetFlow cache between 1024 entries and 524,288 entries. Using the cache entries command (after you configure NetFlow aggregation), you can configure the size of the NetFlow aggregation cache from 1024 entries to 2,000,000 entries.
Caution
Restrictions
If you modify any parameters for the NetFlow main cache after you enable NetFlow, the changes will not take effect until you reboot the router or disable NetFlow on every interface it is enabled on, and then re-enable NetFlow on the interfaces.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
DETAILED STEPS
Configuration Examples for NetFlow and NetFlow Data Export
•
•
•
•
Example: Configuring Egress NetFlow Accounting
The following example shows how to configure Egress NetFlow Accounting:
configure terminal!interface fastethernet 0/0/0ip flow egress!Example: Configuring NetFlow Subinterface Support
This section contains examples for configuring NetFlow Subinterface Support, and contains the following examples:
•
•
Example: NetFlow Subinterface Support for Ingress (Received) Traffic on a Subinterface
configure terminal!interface fastethernet 0/0/0.1ip flow ingress!Example: NetFlow SubInterface Support for Egress (Transmitted) Traffic on a Subinterface
configure terminal!interface fastethernet 1/0/0.1ip flow egress!
Note
Example: Configuring NetFlow Multiple Export Destinations
The following example shows how to configure the NetFlow Multiple Export Destinations feature:
configure terminal!ip flow-export destination 10.10.10.10 9991ip flow-export destination 172.16.10.2 9991!
Note
Example: Configuring NetFlow Version 5 Data Export
The following example shows how to configure the NetFlow data export using the Version 5 export format with the peer AS information.
configure terminal
!
ip flow-export version 5 peer-asip flow-export destination 172.16.10.2 99exitRouter# show ip flow exportFlow export v5 is enabled for main cacheExporting flows to 172.16.10.2 (99)Exporting using source IP address 172.16.6.1Version 5 flow records, peer-as0 flows exported in 0 udp datagrams0 flows failed due to lack of export packet0 export packets were sent up to process level0 export packets were dropped due to no fib0 export packets were dropped due to adjacency issues0 export packets were dropped due to fragmentation failures0 export packets were dropped due to encapsulation fixup failuresRouter#Additional References
Related Documents
Cisco IOS commands
NetFlow commands: complete command syntax, command modes, command history, defaults, usage guidelines, and examples
Tasks for configuring NetFlow input filters
Using NetFlow Filtering or Sampling to Select the Network Traffic to Track
Tasks for configuring Random Sampled NetFlow
Using NetFlow Filtering or Sampling to Select the Network Traffic to Track
Tasks for configuring NetFlow aggregation caches
Information for installing, starting, and configuring the CNS NetFlow Collection Engine
Discussion of NetFlow flow-record formats
Standards
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.
—
MIBs
RFCs
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.
—
Technical Assistance
Feature Information for Configuring NetFlow and NetFlow Data Export
Table 8 lists the features in this module and provides links to specific configuration information.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note
Table 8 Feature Information for Configuring NetFlow and NetFlow Data Export
Egress NetFlow Accounting
Cisco IOS XE Release 2.1
The Egress NetFlow Accounting feature allows NetFlow statistics to be gathered on egress traffic that is exiting the router. Previous versions of NetFlow allow statistics to be gathered only on ingress traffic that enters the router.
In Cisco IOS XE Release 2.1, this feature was introduced on Cisco ASR 1000 Series Routers.
The following sections provide information about this feature:
•
•
The following commands were modified by this feature: flow-sampler, ip flow egress, ip flow-egress input-interface, match, show ip cache flow, show ip cache verbose flow, show ip flow interface.
NetFlow
Cisco IOS XE Release 2.1
NetFlow is a Cisco IOS XE application used to capture network traffic data. It provides statistics on packets flowing through the router, and is emerging as a primary network accounting and security technology.
In Cisco IOS XE Release 2.1, this feature was introduced on Cisco ASR 1000 Series Aggregation Services Routers.
The following sections provide information about this feature:
•
•
The following commands were modified by this feature: flow-sampler, ip flow egress, ip flow-egress input-interface, match, show ip cache flow, show ip cache verbose flow, show ip flow interface.
NetFlow Multiple Export Destinations
Cisco IOS XE Release 2.1
The NetFlow Multiple Export Destinations feature enables configuration of multiple destinations of the NetFlow data.
In Cisco IOS XE Release 2.1, this feature was introduced on Cisco ASR 1000 Series Routers.
The following sections provide information about this feature:
•
•
The following commands were modified by this feature: ip flow-aggregation cache, ip flow-export destination, show ip flow export.
NetFlow Subinterface Support
Cisco IOS XE Release 2.1
The NetFlow Subinterface Support feature provides the ability to enable NetFlow on a per-subinterface basis.
In Cisco IOS XE Release 2.1, this feature was introduced on Cisco ASR 1000 Series Routers.
The following sections provide information about this feature:
•
•
The following commands were introduced or modified by this feature: ip flow ingress, show ip interface.
NetFlow v9 Export Format
(Netflow Data Export [NDE] Version 5)
(Netflow Data Export [NDE] Version 8)
Cisco IOS XE Release 2.1
The NetFlow v9 Export Format is flexible and extensible, which provides the versatility needed to support new fields and record types. This format accommodates new NetFlow-supported technologies such as Multicast and Network Address Translation (NAT).
In Cisco IOS XE Release 2.1, this feature was introduced on Cisco ASR 1000 Series Routers.
The following sections provide information about this feature:
•
•
The following commands were modified by this feature: debug ip flow export, export, ip flow-export, show ip flow export.
Glossary
AS—autonomous system. A collection of networks under a common administration sharing a common routing strategy. Autonomous systems are subdivided by areas. An autonomous system must be assigned a unique 16-bit number by the Internet Assigned Numbers Authority (IANA).
Cisco Express Forwarding—Layer 3 IP switching technology that optimizes network performance and scalability for networks with large and dynamic traffic patterns.
BGP—Border Gateway Protocol. An interdomain routing protocol that replaces Exterior Gateway Protocol (EGP). A BGP system exchanges reachability information with other BGP systems. BGP is defined by RFC 1163.
BGP next hop—IP address of the next hop to be used by a router to reach a certain destination.
export packet—Type of packet built by a device (for example, a router) with NetFlow services enabled that is addressed to another device (for example, the NetFlow Collection Engine). The packet contains NetFlow statistics. The other device processes the packet (parses, aggregates, and stores information on IP flows).
fast switching—Cisco feature in which a route cache is used to expedite packet switching through a router.
flow—A set of packets with the same source IP address, destination IP address, protocol, source/destination ports, and type-of-service, and the same interface on which the flow is monitored. Ingress flows are associated with the input interface, and egress flows are associated with the output interface.
NetFlow—A Cisco IOS XE application that provides statistics on packets flowing through the router. It is emerging as a primary network accounting and security technology.
NetFlow Aggregation—A NetFlow feature that lets you summarize NetFlow export data on an Cisco IOS router before the data is exported to a NetFlow data collection system such as the NetFlow Collection Engine. This feature lowers bandwidth requirements for NetFlow export data and reduces platform requirements for NetFlow data collection devices.
NetFlow v9—NetFlow export format Version 9. A flexible and extensible means for carrying NetFlow records from a network node to a collector. NetFlow Version 9 has definable record types and is self-describing for easier NetFlow Collection Engine configuration.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2006-2011 Cisco Systems, Inc. All rights reserved.
