 Feedback
|
Table Of Contents
Using NetFlow Filtering or Sampling to Select the Network Traffic to Track
Prerequisites for Using NetFlow Filtering or Sampling to Select Network Traffic to Track
Restrictions for Using NetFlow Filtering or Sampling to Select Network Traffic to Track
Information About Using NetFlow Filtering or Sampling to Select Network Traffic to Track
Roadmap: Using NetFlow Filtering or Sampling to Select the Network Traffic to Track
Filtering and Sampling of NetFlow Traffic
NetFlow Input Filters: Flow Classification
Random Sampled NetFlow: Sampling Mode
Random Sampled NetFlow: The NetFlow Sampler
How to Configure NetFlow Filtering or Sampling
Configuring NetFlow Input Filters to Reduce the Impact of NetFlow Data Export
Creating a Class Map for a Policy Map for NetFlow Input Filtering
Creating a Sampler Map for a Policy Map for NetFlow Input Filtering
Creating a Class-Based Policy Containing NetFlow Sampling Actions
Applying a Policy Containing NetFlow Sampling Actions to an Interface
Configuring Random Sampled NetFlow to Reduce the Impact of NetFlow Data Export
Defining a NetFlow Sampler Map
Applying a NetFlow Sampler Map to an Interface
Verifying the Configuration of Random Sampled NetFlow
Configuration Examples for Configuring NetFlow Filtering and Sampling
Example: Configuring NetFlow Input Filters to Reduce the Impact of NetFlow Data Export:
Example: Creating a Class Map for a Policy Map for NetFlow Input Filtering
Example: Creating a Sampler Map for a Policy Map for NetFlow Input Filtering
Example: Creating a Policy Containing NetFlow Sampling Actions
Example: Applying a Policy to an Interface
Example: Configuring Random Sampled NetFlow to Reduce the Impact of NetFlow Data Export
Example: Defining a NetFlow Sampler Map
Example: Applying a NetFlow Sampler Map to an Interface
Feature Information for Using NetFlow Filtering or Sampling to Select Network Traffic to Track
Using NetFlow Filtering or Sampling to Select the Network Traffic to Track
First Published: June 19, 2006Last Updated: December 17, 2010This module contains information about and instructions for selecting the network traffic to track through the use of NetFlow filtering or sampling. The NetFlow Input Filtering and Random Sampled NetFlow features, described in this module, allow you to collect data from specific subsets of traffic.
•
The NetFlow Input Filters feature provides NetFlow data for a specific subset of traffic by letting you create filters to select flows for NetFlow processing. For example, you can select flows from a specific group of hosts.
•
NetFlow is a Cisco IOS application that provides statistics on packets that flow through the router. It is emerging as a primary network accounting and security technology.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Using NetFlow Filtering or Sampling to Select Network Traffic to Track" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•
•
•
•
•
•
Prerequisites for Using NetFlow Filtering or Sampling to Select Network Traffic to Track
Prerequisites for NetFlow Input Filters
Before you can configure the NetFlow Input Filters feature, you must:
•
•
•
Note
Prerequisites for Random Sampled NetFlow
Before you can configure the Random Sampled NetFlow feature, you must:
•
•
•
•
Restrictions for Using NetFlow Filtering or Sampling to Select Network Traffic to Track
Restrictions for NetFlow Input Filters
On Cisco 7500 platforms, the NetFlow Input Filters feature is supported only in distributed mode.
Restrictions for Random Sampled NetFlow
If full NetFlow is enabled on an interface, it takes precedence over Random Sampled NetFlow (which will thus have no effect). This means that you should disable full NetFlow on an interface before enabling Random Sampled NetFlow on that interface.
Enabling Random Sampled NetFlow on a physical interface does not automatically enable Random Sampled NetFlow on subinterfaces; you must explicitly configure it on subinterfaces. Also, disabling Random Sampled NetFlow on a physical interface (or a subinterface) does not enable full NetFlow. This restriction prevents the transition to full NetFlow from overwhelming the physical interface (or subinterface). If you want full NetFlow, you must explicitly enable it.
If you enable Random Sampled NetFlow with Version 5 data export, sampler option templates are not exported, and sampler IDs are exported in the least significant three bits of the last byte of the Version 5 record pad field. Use NetFlow Version 9 if you want to use sampler option templates or view NetFlow sampler IDs.
Information About Using NetFlow Filtering or Sampling to Select Network Traffic to Track
•
•
•
•
•
Roadmap: Using NetFlow Filtering or Sampling to Select the Network Traffic to Track
Table 1 provides a roadmap that includes links to associated information and configuration instruction for selecting traffic of interest.
Table 1 Roadmap: Selecting the Network Traffic to Track Using Sampling and Filtering
A specific subset of NetFlow traffic for the purpose of class-based traffic analysis and monitoring (including on-network or off-network traffic)
Associated information:
•
•
•
•
Configuration instructions:
•
Statistical sampling of network traffic for traffic engineering or capacity planning purposes
Associated information:
•
•
•
•
Configuration instructions:
•
Filtering and Sampling of NetFlow Traffic
NetFlow provides highly granular per-flow traffic statistics in a Cisco router. A flow is a unidirectional stream of packets that arrive at the router on the same subinterface, have the same source and destination IP addresses, Layer 4 protocol, TCP/UDP source and destination ports, and the same type of service (ToS) byte in the IP headers. The router accumulates NetFlow statistics in a NetFlow cache and can export them to an external device (such as the Cisco Networking Services (CNS) NetFlow Collection Engine) for further processing.
Full NetFlow accounts for all traffic entering the subinterface on which it is enabled. But in some cases, you might gather NetFlow data on only a subset of this traffic. The Random Sampled NetFlow feature and the NetFlow Input Filters feature each provide ways to limit incoming traffic to only traffic of interest for NetFlow processing. Random Sampled NetFlow provides NetFlow data for a subset of traffic in a Cisco router by processing only one randomly selected packet out of n sequential packets. The NetFlow Input Filters feature provides the capability to gather NetFlow data on only a specific user-defined subset of traffic.
Note
Note
Table 2 compares the NetFlow Input Filters feature and the NetFlow Random Sampled feature.
NetFlow Input Filters: Flow Classification
For the NetFlow Input Filters feature, classification of packets can be based on any of the following: IP source and destination addresses, Layer 4 protocol and port numbers, incoming interface, MAC address, IP Precedence, DSCP value, Layer 2 information (such as Frame-Relay DE bits or Ethernet 802.1p bits), and Network-Based Application Recognition (NBAR) information. The packets are classified (filtered) on the above criteria, and flow accounting is applied to them on subinterfaces.
The filtering mechanism uses the Modular QoS Command-Line Interface (MQC) to classify flows. You can create multiple filters with matching samplers on a per-subinterface basis. For example, you can subdivide subinterface traffic into multiple classes based on type of service (ToS) values or destination prefixes (or both). For each class, you can also configure sampling at a different rate, using higher rates for higher-priority classes of traffic and lower rates for lower-priority ones.
MQC has many policies (actions) such as bandwidth rate and queuing management. These policies are applied only if a packet matches a criterion in a class map that is applied to the subinterface. A class map contains a set of match clauses and instructions on how to evaluate the clauses and acts as a filter for the policies, which are applied only if a packet's content satisfies the match clause. The NetFlow Input Filters feature adds NetFlow accounting to the MQC infrastructure, which means that flow accounting is done on a packet only if it satisfies the match clauses.
Two types of filter are available:
•
•
Random Sampled NetFlow: Sampling Mode
Sampling mode makes use of an algorithm that selects a subset of traffic for NetFlow processing. In the random sampling mode that the Random Sampled NetFlow feature uses, incoming packets are randomly selected so that one out of each n sequential packets is selected on average for NetFlow processing. For example, if you set the sampling rate to 1 out of 100 packets, then NetFlow might sample the 5th packet and then the 120th, 199th, 302nd, and so on. This sample configuration provides NetFlow data on 1 percent of total traffic. The n value is a parameter from 1 to 65535 packets that you can configure.
Random Sampled NetFlow: The NetFlow Sampler
A NetFlow sampler map defines a set of properties (such as the sampling rate and NetFlow sampler name) for NetFlow sampling. Each NetFlow sampler map can be applied to one or many subinterfaces as well as physical interfaces. You can define up to eight NetFlow sampler maps.
For example, you can create a NetFlow sampler map named mysampler1 with the following properties: random sampling mode and a sampling rate of 1 out of 100 packets. This NetFlow sampler map can be applied to any number of subinterfaces, each of which would refer to mysampler1 to perform NetFlow sampling. Traffic from these subinterfaces is merged (from a sampling point of view). This introduces even more "randomness" than random per-subinterface NetFlow sampling does, but statistically it provides the same sampling rate of 1 out of 100 packets for each participating subinterface.
The sampling in random sampled NetFlow is done by NetFlow samplers. A NetFlow sampler is defined as an instance of a NetFlow sampler map that has been applied to a physical interface or subinterface. If full NetFlow is configured on a physical interface, it overrides random sampled NetFlow on all subinterfaces of this physical interface.
How to Configure NetFlow Filtering or Sampling
•
•
Note
Configuring NetFlow Input Filters to Reduce the Impact of NetFlow Data Export
Perform the following tasks to configure NetFlow input filters. Configuring NetFlow input filters reduces the impact of NetFlow data export.
•
•
•
•
Creating a Class Map for a Policy Map for NetFlow Input Filtering
Perform the following steps to create a class map for a policy map for NetFlow input filtering.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Creating a Sampler Map for a Policy Map for NetFlow Input Filtering
Perform the following steps to create a sampler map for a policy map for NetFlow input filtering.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Creating a Class-Based Policy Containing NetFlow Sampling Actions
Perform thefollowing steps to create a class-based policy that contains NetFlow sampling actions.
You can assign only one NetFlow input filters sampler to a class. Assigning a subsequent NetFlow input filters sampler to a class overwrites the previous sampler. Removing a NetFlow sampler map also removes the NetFlow input filters sampler from the corresponding policy map.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Applying a Policy Containing NetFlow Sampling Actions to an Interface
Perform the following steps to apply a policy containing NetFlow sampling actions to an interface.
After you define a service policy with the policy-map command, you use the service-policy command in interface configuration mode to attach it to one or more interfaces, thus specifying the service policy for those interfaces. Although you can assign the same service policy to multiple interfaces, each interface can have only one service policy attached. You can apply the service policy only in the input direction.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Troubleshooting Tips
Use the debug flow-sampler class-based command to display debugging output for NetFlow input filters.
Configuring Random Sampled NetFlow to Reduce the Impact of NetFlow Data Export
Perform the following tasks to configure and verify the configuration for the Random Sampled NetFlow feature:
•
•
•
Defining a NetFlow Sampler Map
Perform the following task to define a NetFlow sampler map.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Applying a NetFlow Sampler Map to an Interface
Perform the following task to apply a NetFlow sampler map to an interface.
You can apply a NetFlow sampler map to a physical interface (or a subinterface) to create a NetFlow sampler.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Verifying the Configuration of Random Sampled NetFlow
Perform the following tasks to verify the configuration of the Random Sampled NetFlow feature.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
Step 1
Use this command to display attributes (including mode, sampling rate, and number of sampled packets) of one or all Random Sampled NetFlow samplers to verify the sampler configuration. For example:
Router# show flow-samplerSampler : mysampler1, id : 1, packets matched : 10, mode : random sampling modesampling interval is : 100Sampler : myflowsampler2, id : 2, packets matched : 5, mode : random sampling modesampling interval is : 200To verify attributes for a particular NetFlow sampler, use the show flow-sampler sampler-map-name command. For example, enter the following for a NetFlow sampler named mysampler1:
Router# show flow-sampler mysampler1Sampler : mysampler1, id : 1, packets matched : 0, mode : random sampling modesampling interval is : 100Step 2
Use this command to display additional NetFlow fields in the header when Random Sampled NetFlow is configured. For example:
Router# show ip cache verbose flow...SrcIf SrcIPaddress DstIf DstIPaddress Pr TOS Flgs PktsPort Msk AS Port Msk AS NextHop B/Pk ActiveBGP: BGP NextHopEt1/0 8.8.8.8 Et0/0* 9.9.9.9 01 00 10 30000 /8 302 0800 /8 300 3.3.3.3 100 0.1BGP: 2.2.2.2 Sampler: 1 Class: 1 FFlags: 01This example shows the NetFlow output of the show ip cache verbose flow command in which the sampler, class-id, and general flags are set. What is displayed for a flow depends on what flags are set in the flow. If the flow was captured by a sampler, the output shows the sampler ID. If the flow was marked by MQC, the display includes the class ID. If any general flags are set, the output includes the flags.
NetFlow flags (FFlags) that might appear in the show ip cache verbose flow command output are:
•
•
•
•
•
IPv6 and RSVD FFlags are seldom used. If FFlags is zero, the line is omitted from the output. If multiple flags are defined (logical ORed together), then both sets of flags are displayed in hexadecimal format.
Step 3
Use this command to display the statistics for the NetFlow data export (such as template timeout and refresh rate) for the template-specific configurations. For example:
Router# show ip flow export templateTemplate Options Flag = 0Total number of Templates added = 0Total active Templates = 0Flow Templates active = 0Flow Templates added = 0Option Templates active = 0Option Templates added = 0Template ager polls = 0Option Template ager polls = 0Main cache version 9 export is enabledTemplate export informationTemplate timeout = 30Template refresh rate = 20Option export informationOption timeout = 30Option refresh rate = 20
Troubleshooting Tips
Use the debug flow-sampler command to display debugging output for the Random Sampled NetFlow feature.
Configuration Examples for Configuring NetFlow Filtering and Sampling
•
•
Example: Configuring NetFlow Input Filters to Reduce the Impact of NetFlow Data Export:
•
•
•
•
Example: Creating a Class Map for a Policy Map for NetFlow Input Filtering
The following example shows how to create a class map for a policy map for NetFlow input filtering. In the example, class maps named my_high_importance_class and my_medium_importance_class are created.
configure terminal!class-map my_high_importance_classmatch access-group 101exit!class-map my_medium_importance_classmatch access-group 102endExample: Creating a Sampler Map for a Policy Map for NetFlow Input Filtering
The following example shows how to create a sampler map for a policy map for NetFlow input filtering. In the following example, sampler maps called my_high_sampling, my_medium sampling, and my_low_samplng are created for use with a policy map for NetFlow input filtering.
configure terminal!flow-sampler-map my_high_samplingmode random one-out-of 1exit!flow-sampler-map my_medium_samplingmode random one-out-of 100exit!flow-sampler-map my_low_samplingmode random one-out-of 1000endExample: Creating a Policy Containing NetFlow Sampling Actions
The following example shows how to create a class-based policy containing three NetFlow sampling actions. In this example, a sampling action named my_high_sampling is applied to a class named my_high_importance_class, a sampling action named my_medium_sampling is applied to a class named my_medium_importance_class, and a sampling action named my_low_sampling is applied to the default class.
configure terminal!policy-map mypolicymapclass my_high_importance_classnetflow sampler my_high_samplingexit!class my_medium_importance_classnetflow-sampler my_medium_samplingexit!class class-defaultnetflow-sampler my_low_samplingendExample: Applying a Policy to an Interface
The following example shows how to apply a policy containing NetFlow sampling actions to an interface. In this example, a policy named mypolicymap is attached to interface POS1/0 and also to interface ATM2/0.
configure terminal!interface POS1/0service-policy input mypolicymapexit!interface ATM2/0service-policy input mypolicymapendExample: Configuring Random Sampled NetFlow to Reduce the Impact of NetFlow Data Export
•
•
Example: Defining a NetFlow Sampler Map
The following example shows how to define a NetFlow sampler map named mysampler1:
configure terminal!flow-sampler-map mysampler1mode random one-out-of 100endExample: Applying a NetFlow Sampler Map to an Interface
The following example shows how to enable CEF switching and apply a NetFlow sampler map named mysampler1 to Ethernet interface 1 to create a NetFlow sampler on that interface:
configure terminal!ip cef!interface ethernet 1/0flow-sampler mysampler1endAdditional References
Related Documents
Cisco IOS commands
NetFlow commands
Overview of Cisco IOS NetFlow
List of the features documented in the Cisco IOS NetFlow Configuration Guide
The minimum information about and tasks required for configuring NetFlow and NetFlow Data Export
Getting Started with Configuring NetFlow and NetFlow Data Export
Tasks for configuring NetFlow to capture and export network traffic data
Tasks for configuring MPLS Aware NetFlow
Tasks for configuring MPLS egress NetFlow accounting
Tasks for configuring Random Sampled NetFlow
Using NetFlow Filtering or Sampling to Select the Network Traffic to Track
Tasks for configuring NetFlow aggregation caches
Tasks for configuring NetFlow BGP next hop support
Configuring NetFlow BGP Next Hop Support for Accounting and Analysis
Tasks for configuring NetFlow multicast support
Tasks for detecting and analyzing network threats with NetFlow
Tasks for configuring NetFlow Reliable Export With SCTP
Tasks for configuring NetFlow Layer 2 and Security Monitoring Exports
Tasks for configuring the SNMP NetFlow MIB
Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data
Tasks for configuring the NetFlow MIB and Top Talkers feature
Configuring NetFlow Top Talkers using Cisco IOS CLI Commands or SNMP Commands
Information for installing, starting, and configuring the CNS NetFlow Collection Engine
Standards
MIBs
None
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
RFCs
Technical Assistance
Feature Information for Using NetFlow Filtering or Sampling to Select Network Traffic to Track
Table 3 lists the features in this module and provides links to specific configuration information.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note
Table 3 Feature Information for Using NetFlow Filtering or Sampling to Select Network Traffic to Track
NetFlow Input Filters
12.3(4)T,
12.2(25)S
12.2(27)SBC
15.0(1)SThe NetFlow Input Filters feature provides NetFlow data for a specific subset of traffic by letting you create filters to select flows for NetFlow processing. For example, you can select flows from a specific group of hosts. This feature also lets you select various sampling rates for selected flows. The NetFlow Input Filters feature is used, for example, for class-based traffic analysis and monitoring on-network or off-network traffic.
The following sections provide information about this feature:
•
•
•
•
The following commands were introduced or modified by this feature: netflow-sampler and debug flow-sampler.
Random Sampled NetFlow
12.3(4)T,
12.2(18)S,
12.0(26)S,
12.2(27)SBC
12.2(33)SRCRandom Sampled NetFlow provides NetFlow data for a subset of traffic in a Cisco router by processing only one randomly selected packet out of n sequential packets (n is a user-configurable parameter). Packets are sampled as they arrive (before any NetFlow cache entries are made for those packets). Statistical traffic sampling substantially reduces consumption of router resources (especially CPU resources) while providing valuable NetFlow data. The main uses of Random Sampled NetFlow are traffic engineering, capacity planning, and applications where full NetFlow is not needed for an accurate view of network traffic.
In Cisco IOS Release 12.2(33)SRC, this feature was enhanced to support IPv6 unicast and IPv4 multicast functionality.
The following sections provide information about this feature:
•
•
•
•
•
The following commands were introduced by this feature: debug flow-sampler, flow-sampler, flow-sampler-map, mode (flow sampler map configuration), and show flow-sampler.
The following command was modified by this feature: ip flow-export.
Glossary
ACL—Access control list. A roster of users and groups of users kept by a router. The list is used to control access to or from the router for a number of services.
BGP—Border Gateway Protocol. Interdomain routing protocol that replaces Exterior Gateway Protocol (EGP). A BGP system exchanges reachability information with other BGP systems. BGP is defined by RFC 1163.
BGP next hop—IP address of the next hop to be used to reach a certain destination.
CEF—Cisco Express Forwarding. Layer 3 IP switching technology that optimizes network performance and scalability for networks with large and dynamic traffic patterns.
dCEF—Distributed Cisco Express Forwarding. A type of CEF switching in which line cards (such as Versatile Interface Processor (VIP) line cards) maintain identical copies of the forwarding information base (FIB) and adjacency tables. The line cards perform the express forwarding between port adapters; this relieves the Route Switch Processor of involvement in the switching operation.
fast switching—Cisco feature in which a route cache is used to expedite packet switching through a router.
flow—Unidirectional stream of packets between a given source and destination. Source and destination are each defined by a network-layer IP address and transport-layer source and destination port numbers.
MQC—Modular QoS command-line interface. A CLI structure that lets you create traffic polices and attach them to interfaces. A traffic policy contains a traffic class and one or more QoS features. The QoS features in the traffic policy determine how the classified traffic is treated.
NBAR—Network-Based Application Recognition. A classification engine in Cisco IOS software that recognizes a wide variety of applications, including web-based applications and client/server applications that dynamically assign Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port numbers. After the application is recognized, the network can invoke specific services for that application. NBAR is a key part of the Cisco Content Networking architecture and works with QoS features to let you use network bandwidth efficiently.
NetFlow—Cisco IOS security and accounting feature that maintains per-flow information.
NetFlow sampler—A set of properties that are defined in a NetFlow sampler map that has been applied to at least one physical interface or subinterface.
NetFlow sampler map—The definition of a set of properties (such as the sampling rate) for NetFlow sampling.
NetFlow v9—NetFlow export format Version 9. A flexible and extensible means for carrying NetFlow records from a network node to a collector. NetFlow Version 9 has definable record types and is self-describing for easier NetFlow Collection Engine configuration.
ToS—type of service. Second byte in the IP header that indicates the desired quality of service for a specific datagram.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2006-2010 Cisco Systems, Inc. All rights reserved.
