Information About NetFlow
NetFlow identifies packet flows for both ingress and egress IP packets and provides statistics based on these packet flows. NetFlow does not require any change to either the packets themselves or to any networking device.
This section includes the following topics:
NetFlow Overview
NetFlow uses flows to provide statistics for accounting, network monitoring, and network planning. A flow is a unidirectional stream of packets that arrives on a source interface (or VLAN) and has the same values for the keys. A key is an identified value for a field within the packet. You create a flow using a flow record to define the unique keys for your flow.
Cisco NX-OS supports the Flexible NetFlow feature that enables enhanced network anomalies and security detection. Flexible NetFlow allows you to define an optimal flow record for a particular application by selecting the keys from a large collection of predefined fields. For more information on the flow records, see the “Flow Records” section.
All key values must match for the packet to count in a given flow. A flow might gather other fields of interest, depending on the export record version that you configure. Flows are stored in the NetFlow cache.
You can export the data that NetFlow gathers for your flow by using an exporter and export this data to a remote NetFlow collector. Cisco NX-OS exports a flow as part of a NetFlow export User Datagram Protocol (UDP) datagram under the following circumstances:
-
The flow has been inactive or active for too long.
-
The flow cache is getting full.
-
One of the counters (packets or bytes) has exceeded its maximum value.
-
You have forced the flow to export.
For more information on exporters, see the “Exporters” section.
You define the size of the data that you want to collect for a flow using a monitor. The monitor combines the flow record and exporter with the NetFlow cache information. For more information on monitors, see the “Monitors” section.
Cisco NX-OS can gather NetFlow statistics in either full or sampled mode. Cisco NX-OS analyzes all packets on the interface or subinterface for full NetFlow mode. For sampled mode, you configure the sampling algorithm and rate that Cisco NX-OS analyzes packets. For more information on samplers, see the “Samplers” section.
Flow Records
A flow record defines the keys that NetFlow uses to identify packets in the flow as well as other fields of interest that NetFlow gathers for the flow. You can define a flow record with any combination of keys and fields of interest. Cisco NX-OS supports a rich set of keys. A flow record also defines the types of counters gathered per flow. You can configure 32-bit or 64-bit packet or byte counters. Cisco NX-OS enables the following match fields as the defaults when you create a flow record:
-
match interface input
-
match interface output
-
match flow direction
For more information, see the “Creating a Flow Record” section.
Exporters
An exporter contains network layer and transport layer details for the NetFlow export packet. You can configure the following information in an exporter:
-
Export destination IP address
-
Source interface
-
UDP port number (where the collector is listening for NetFlow packets)
-
Export format
Note NetFlow export packets use the IP address that is assigned to the source interface. If the source interface does not have an IP address assigned to it, the exporter will be inactive.
Cisco NX-OS exports data to the collector whenever a timeout occurs or when the flow is terminated (TCP Fin or Rst received, for example). You can configure the following timers to force a flow export:
-
Active timeout—Cisco NX-OS does not remove the cache entries from the cache.
-
Inactive timeout—Cisco NX-OS removes the cache entries from the cache.
Export Formats
Cisco NX-OS supports the Version 5 and Version 9 export formats. We recommend that you use the Version 9 export format for the following reasons:
-
Variable field specification format
-
Support for IPv6, Layer 2, and MPLS fields
-
More efficient network utilization
If you configure the Version 5 export format, you have these limitations:
-
Fixed field specifications
-
No support for IPv6, Layer 2, or MPLS fields
-
The Netflow.InputInterface and Netflow.OutputInterface represent a 16-bit I/O descriptor (IOD) of the interface.
Note The IOD information of the interface can be retrieved using the show system internal im info global command.
For information about the Version 9 export format, see
RFC 3954
.
Note Cisco NX-OS supports UDP as the transport protocol for exports to up to two collectors.
Monitors
A monitor references the flow record and flow exporter. You apply a monitor to an interface.
Samplers
If you are using sampled mode, you use the sampler to specify the rate at which packets are sampled. On high bandwidth interfaces, applying NetFlow processing to every single packet can result in high CPU utilization. Sampler configuration is for high-speed interfaces. You can configure samples for M out of N. For example, 100 out of every 10,000 packets are sampled.
High Availability
Cisco NX-OS supports stateful restarts for NetFlow. After a reboot or supervisor switchover, Cisco NX-OS applies the running configuration.
Virtualization Support
A virtual device context (VDC) is a logical representation of a set of system resources. Within each VDC, you can configure NetFlow. By default, Cisco NX-OS places you in the default VDC and any flows that you define in this mode are only available for interfaces in the default VDC.
For information about configuring VDCs, see the
Cisco Nexus 7000 Series NX-OS Virtual Device Context Configuration Guide, Release 5.x
.
Configuring NetFlow
To configure NetFlow, follow these steps:
Step 1 Enable the NetFlow feature (see the “Enabling the NetFlow Feature” section).
Step 2 Define a flow record by specifying keys and fields to the flow (see the “Creating a Flow Record” section).
Step 3 Define an optional flow exporter by specifying the export format, protocol, destination, and other parameters (see the “Creating a Flow Exporter” section).
Step 4 Define a flow monitor based on the flow record and flow exporter (see the “Creating a Flow Monitor” section).
Step 5 Apply the flow monitor to a source interface, subinterface, VLAN interface (see the “Applying a Flow to an Interface” section), or a VLAN (see the “Configuring Bridged NetFlow on a VLAN” section).
This section includes the following topics:
Note Be aware that the Cisco NX-OS commands for this feature may differ from those used in Cisco IOS.
Enabling the NetFlow Feature
You must globally enable NetFlow before you can configure any flows.
Use the following command in global configuration mode to enable NetFlow:
|
|
feature netflow
Example
:
switch(config)# feature netflow
|
Enables the NetFlow feature.
|
Use the following command in global configuration mode to disable NetFlow and remove all flows:
|
|
no feature netflow
Example
:
switch(config)# no feature netflow
|
Disables the NetFlow feature. The default is disabled.
|
Creating a Flow Record
You can create a flow record and add keys to match on and fields to collect in the flow.
BEFORE YOU BEGIN
Make sure that you are in the correct VDC. To change the VDC, use the
switchto vdc
command.
SUMMARY STEPS
1.
config t
2.
flow record
name
3.
description
string
4.
match
type
5.
collect
type
6.
show flow record
[
name
] [
record-name
|
netflow-original
|
netflow protocol-port
|
netflow
{
ipv4
|
ipv6
} {
original-input
|
original-output
}}
7.
copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1
|
config t
Example:
switch# config t
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)#
|
Places you in global configuration mode.
|
Step 2
|
flow record
name
Example:
switch(config)# flow record Test
switch(config-flow-record)#
|
Creates a flow record and enters flow record configuration mode.
|
Step 3
|
description
string
Example:
switch(config-flow-record)# description Ipv4Flow
|
(Optional) Describes this flow record as a maximum 63-character string.
|
Step 4
|
match
type
Example:
switch(config-flow-record)# match transport destination-port
|
Specifies a match key. See the “Specifying the Match Parameters” section for more information on the
type
argument.
|
Step 5
|
collect
type
Example:
switch(config-flow-record)# collect counter packets
|
Specifies the collection field. See the “Specifying the Collect Parameters” section for more information on the
type
argument.
|
Step 6
|
show flow record
[
name
] [
record-name
|
netflow-original
|
netflow protocol-port
|
netflow
{
ipv4
|
ipv6
} {
original-input
|
original-output
}}
Example:
switch(config-flow-exporter)# show flow record netflow protocol-port
|
(Optional) Displays information about NetFlow flow records.
|
Step 7
|
copy running-config startup-config
Example:
switch(config-flow-exporter)# copy running-config startup-config
|
(Optional) Saves this configuration change.
|
Specifying the Match Parameters
You must configure at least one of the following match parameters for flow records:
|
|
match ip
{
protocol
|
tos
}
Example:
switch(config-flow-record)# match ip protocol
|
Specifies the IP protocol or ToS fields as keys.
|
match ipv4
{
destination address
|
source
address
}
Example:
switch(config-flow-record)# match ipv4 destination address
|
Specifies the IPv4 source or destination address as a key.
|
match ipv6
{
destination address
|
source
address
|
flow-label
|
options
}
Example:
switch(config-flow-record)# match ipv6 flow-label
|
Specifies the IPv6 key.
|
match transport
{
destination-port
|
source-port
}
Example:
switch(config-flow-record)# match transport destination-port
|
Specifies the transport source or destination port as a key.
|
match datalink
{
mac source-address
|
mac destination-address
|
ethertype
|
vlan
}
Example:
switch(config-flow-record)# match datalink ethertype
|
Specifies the Layer 2 attribute as a key.
|
Specifying the Collect Parameters
You must configure at least one of the following collect parameters for flow records:
|
|
collect counter
{
bytes
|
packets
} [
long
]
Example:
switch(config-flow-record)# collect counter packets
|
Collects either packet-based or byte counters from the flow. You can optionally specify that 64-bit counters are used.
|
collect flow
{
direction
|
sampler id
}
Example:
switch(config-flow-record)# collect flow direction
|
Collects the direction of the flow or the sampler identifier used for the flow.
|
collect interface {input | output}
Example:
switch(config-flow-record)# collect interface input
|
Collects the input or output interface attribute.
|
collect routing
{
destination
|
source
}
as
[
peer
]
Example:
switch(config-flow-record)# collect routing destination as
|
Collects the source or destination AS number of the local device or the peer.
|
collect routing forwarding-status
Example:
switch(config-flow-record)# collect routing forwarding-status
|
Collects the forwarding status of the packet.
|
collect routing next-hop address ipv4
[
bgp
]
Example:
switch(config-flow-record)# collect routing next-hop address ipv4
|
Collects the next-hop IPv4 address.
|
collect routing next-hop address ipv6
[
bgp
]
Example:
switch(config-flow-record)# collect routing next-hop address ipv6
|
Collects the next-hop IPv6 address.
|
collect timestamp sys-uptime
{
first
|
last
}
Example:
switch(config-flow-record)# collect timestamp sys-uptime last
|
Collects the system up time for the first or last packet in the flow.
|
collect transport tcp flags
Example:
switch(config-flow-record)# collect transport tcp flags
|
Collects the TCP transport layer flags for the packets in the flow.
|
Creating a Flow Exporter
You can create a flow export to define the export parameters for a flow.
BEFORE YOU BEGIN
Make sure that you are in the correct VDC. To change the VDC, use the
switchto vdc
command.
SUMMARY STEPS
1.
config t
2.
flow exporter
name
3.
destination
{
ipv4-address
|
ipv6-address
} [
use-vrf
name
]
4.
source
interface-type number
5.
version
{
5
|
9
}
6.
show flow exporter
[
name
]
7.
copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1
|
config t
Example:
switch# config t
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)#
|
Places you in global configuration mode.
|
Step 2
|
flow exporter
name
Example:
switch(config)# flow exporter ExportTest
switch(config-flow-exporter)#
|
Creates a flow exporter and enters flow exporter configuration mode.
|
Step 3
|
destination
{
ipv4-address
|
ipv6-address
} [
use-vrf
name
]
Example:
switch(config-flow-exporter)# destination 192.0.2.1
|
Sets the destination IPv4 or IPv6 address for this exporter. You can optionally configure the VRF to use to reach the NetFlow collector.
|
Step 4
|
source
interface-type number
Example:
switch(config-flow-exporter)# source ethernet 2/1
|
Specifies the interface to use to reach the NetFlow collector at the configured destination.
|
Step 5
|
version
{
5
|
9
}
Example:
switch(config-flow-exporter)# version 9
switch(config-flow-exporter-version-9)#
|
Specifies the NetFlow export version. Version 9 enters the export version configuration submode.
|
Step 6
|
show flow exporter
[
name
]
Example:
switch(config-flow-exporter)# show flow exporter
|
(Optional) Displays information about NetFlow flow exporters.
|
Step 7
|
copy running-config startup-config
Example:
switch(config-flow-exporter)# copy running-config startup-config
|
(Optional) Saves this configuration change.
|
You can optionally configure the following parameters for flow exporters:
|
|
description
string
Example:
switch(config-flow-exporter)# description ExportV9
|
Describes this flow exporter as a maximum 63-character string.
|
dscp
value
Example:
switch(config-flow-exporter)# dscp 0
|
Specifies the differentiated services codepoint value. The range is from 0 to 63.
|
transport udp number
Example:
switch(config-flow-exporter)# transport udp 200
|
Specifies the UDP port to use to reach the NetFlow collector. The range is from 0 to 65535.
|
You can optionally configure the following parameters in flow exporter version configuration submode:
|
|
option
{
exporter-stats
|
interface-table
|
sampler-table
}
timeout
seconds
Example:
switch(config-flow-exporter-version-9)# option exporter-stats timeout 1200
|
Sets the exporter resend timer. The range is from 1 to 86400 seconds.
|
template data timeout
seconds
Example:
switch(config-flow-exporter-version-9)# template data timeout 1200
|
Sets the template data resend timer. The range is from 1 to 86400 seconds.
|
Creating a Flow Monitor
You can create a flow monitor and associate it with a flow record and a flow exporter.
BEFORE YOU BEGIN
Make sure that you are in the correct VDC. To change the VDC, use the
switchto vdc
command.
SUMMARY STEPS
1.
config t
2.
flow monitor
name
3.
description
string
4.
exporter
name
5.
record
{
name
|
netflow-original
|
netflow protocol-port
|
netflow
{
ipv4
|
ipv6
} {
original-input
|
original-output
}}
6.
show flow monitor
[
name
]
7.
copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1
|
config t
Example:
switch# config t
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)#
|
Places you in global configuration mode.
|
Step 2
|
flow monitor
name
Example:
switch(config)# flow monitor MonitorTest
switch(config-flow-monitor)#
|
Creates a flow monitor and enters flow monitor configuration mode.
|
Step 3
|
description
string
Example:
switch(config-flow-monitor)# description Ipv4Monitor
|
(Optional) Describes the flow monitor with an alphanumeric string up to 63 characters.
|
Step 4
|
exporter
name
Example:
switch(config-flow-monitor)# exporter Exportv9
|
Associates a flow exporter with this flow monitor.
|
Step 5
|
record
{
name
|
netflow-original
|
netflow protocol-port
|
netflow
{
ipv4
|
ipv6
} {
original-input
|
original-output
}}
Example:
switch(config-flow-monitor)# record IPv4Flow
|
Associates a flow record with the specified flow monitor.
|
Step 6
|
show flow monitor
[
name
]
Example:
switch(config-flow-monitor)# show flow monitor
|
(Optional) Displays information about NetFlow flow monitors.
|
Step 7
|
copy running-config startup-config
Example:
switch(config-flow-monitor)# copy running-config startup-config
|
(Optional) Saves this configuration change.
|
Creating a Sampler
You can create a sampler to define the NetFlow sampling rate for a flow.
BEFORE YOU BEGIN
Make sure that you are in the correct VDC. To change the VDC, use the
switchto vdc
command.
SUMMARY STEPS
1.
config t
2.
sampler
name
3.
description
string
4.
mode
samples
out-of
packets
5.
show sampler
[
name
]
6.
copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1
|
config t
Example:
switch# config t
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)#
|
Places you in global configuration mode.
|
Step 2
|
sampler
name
Example:
switch(config)# sampler SampleTest
switch(config-flow-sampler)#
|
Creates a sampler and enters flow sampler configuration mode.
|
Step 3
|
description
string
Example:
switch(config-flow-sampler)# description Samples
|
(Optional) Describes the sampler with an alphanumeric string up to 63 characters.
|
Step 4
|
mode
samples
out-of
packets
Example:
switch(config-flow-sampler)# mode 1 out-of 100
|
Defines the number of samples to take per the number of packets received. The samples range is from 1 to 64. The packets range is from 1 to 8192 packets.
|
Step 5
|
show sampler
[
name
]
Example:
switch(config-flow-sampler)# show sampler
|
(Optional) Displays information about NetFlow samplers.
|
Step 6
|
copy running-config startup-config
Example:
switch(config-flow-sampler)# copy running-config startup-config
|
(Optional) Saves this configuration change.
|
Applying a Flow to an Interface
You can apply a flow monitor and an optional sampler to an interface.
BEFORE YOU BEGIN
Make sure that you are in the correct VDC. To change the VDC, use the
switchto vdc
command.
SUMMARY STEPS
1.
config t
2.
interface
interface-type number
3.
ip flow monitor
name
{
input
|
output
} [
sampler
name
]
4.
ipv6 flow monitor
name
{
input
|
output
} [
sampler
name
]
5.
show flow interface
[
interface-type number
]
6.
copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1
|
config t
Example:
switch# config t
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)#
|
Places you in global configuration mode.
|
Step 2
|
interface
interface-type number
Example:
switch(config)# interface ethernet 2/1
switch(config-if)#
|
Enters interface configuration mode. The interface type can be Ethernet (including subinterfaces), port channel, VLAN, VLAN interface, or tunnel.
|
Step 3
|
ip flow monitor
name
{
input
|
output
} [
sampler
name
]
Example:
switch(config-if)# ip flow monitor MonitorTest input
|
Associates an IPv4 flow monitor and an optional sampler to the interface for input or output packets.
|
Step 4
|
ipv6 flow monitor
name
{
input
|
output
} [
sampler
name
]
Example:
switch(config-if)# ipv6 flow monitor MonitorTest input
|
Associates an IPv6 flow monitor and an optional sampler to the interface for input or output packets.
|
Step 5
|
show flow
interface
[
interface-type number
]
Example:
switch(config-if# show flow interface
|
(Optional) Displays information about NetFlow on an interface.
|
Step 6
|
copy running-config startup-config
Example:
switch(config-if)# copy running-config startup-config
|
(Optional) Saves this configuration change.
|
Configuring Bridged NetFlow on a VLAN
You can apply a flow monitor and an optional sampler to a VLAN.
BEFORE YOU BEGIN
Make sure that you are in the correct VDC. To change the VDC, use the
switchto vdc
command.
SUMMARY STEPS
1.
config t
2.
vlan [configuration]
vlan-id
3.
ip flow monitor
name
{
input
|
output
} [
sampler
name
]
4.
copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1
|
config t
Example:
switch# config t
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)#
|
Places you in global configuration mode.
|
Step 2
|
vlan [configuration]
vlan-id
Example:
switch(config)# vlan configuration 30
switch(config-vlan-config)#
|
Enters VLAN or VLAN configuration mode. The
vlan-id
range is from 1 to 3967 or from 4048 to 4093.
Note VLAN configuration mode enables you to configure VLANs independently of their creation, which is required for VTP client support.
|
Step 3
|
ip flow monitor
name
{
input
|
output
} [
sampler
name
]
Example:
switch(config-vlan-config)# ip flow monitor MonitorTest input
|
Associates a flow monitor and an optional sampler to the VLAN for input or output packets.
|
Step 4
|
copy running-config startup-config
Example:
switch(config-vlan-config)# copy running-config startup-config
|
(Optional) Saves this configuration change.
|
Configuring Layer 2 NetFlow
You can define Layer 2 keys in flexible NetFlow records that you can use to capture flows in Layer 2 interfaces. The Layer 2 keys are as follows:
-
Source and destination MAC addresses
-
Source VLAN ID
-
EtherType from the Ethernet frame
You can apply Layer 2 NetFlow to the following interfaces for the ingress direction:
-
Switch ports in access mode
-
Switch ports in trunk mode
-
Layer 2 port channels
Note You cannot apply Layer 2 NetFlow to VLANs, egress interfaces, or Layer 3 interfaces such as VLAN interfaces.
BEFORE YOU BEGIN
Make sure that you are in the correct VDC. To change the VDC, use the
switchto vdc
command.
SUMMARY STEPS
1.
config t
2.
flow record
name
3.
match datalink
{
mac source-address
|
mac destination-address
|
ethertype
|
vlan
}
4.
interface
{
ethernet
slot
/
port
} | {
port-channel
number
}
5.
switchport
6. mac packet-classify
7.
layer2-switched flow monitor
flow-name
input
[
sampler
sampler-name
]
8.
show flow record netflow layer2-switched input
9.
copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1
|
config t
Example:
switch# config t
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)#
|
Places you in global configuration mode.
|
Step 2
|
flow record
name
Example:
switch(config)# flow record L2_record
|
Enters flow record configuration mode. For more information about configuring flow records, see the “Creating a Flow Record” section.
|
Step 3
|
match datalink
{
mac source-address
|
mac destination-address
|
ethertype
|
vlan
}
Example:
switch(config-flow-record)# match datalink ethertype
|
Specifies the Layer 2 attribute as a key.
|
Step 4
|
interface
{
ethernet
slot
/
port
} | {
port-channel
number
}
Example 1:
switch(config)# interface ethernet 2/1
switch(config-if)#
Example 2:
switch(config)# interface port-channel 8
switch(config-if)#
|
Enters interface configuration mode. The interface type can be a physical Ethernet port or a port channel.
|
Step 5
|
switchport
Example:
switch(config-if)# switchport
|
Changes the interface to a Layer 2 physical interface. For information about configuring switch ports, see the
Cisco Nexus 7000 Series NX-OS Layer 2 Switching Configuration Guide, Release 5.x
.
|
Step 6
|
mac packet-classify
Example:
switch(config-if)# mac packet-classify
|
Forces MAC classification of packets. For more information about using the
mac packet-classify
command, see the
Cisco Nexus 7000 Series NX-OS Security Configuration Guide, Release 5.x
.
|
Step 7
|
layer2-switched flow monitor
flow-name
input
[
sampler
sampler-name
]
Example:
switch(config-vlan)# layer2-switched flow monitor L2_monitor input sampler L2_sampler
|
Associates a flow monitor and an optional sampler to the switch port input packets. For information about flow monitors, see the “Creating a Flow Monitor” section. For information about samplers, see the “Creating a Sampler” section.
|
Step 8
|
show flow
record netflow layer2-switched input
Example:
switch(config-if# show flow record netflow layer2-switched input
|
(Optional) Displays information about the Layer 2 NetFlow default record.
|
Step 9
|
copy running-config startup-config
Example:
switch(config-vlan)# copy running-config startup-config
|
(Optional) Saves this configuration change.
|
Configuring NetFlow Timeouts
You can optionally configure global NetFlow timeouts that apply to all flows.
Use the following commands in global configuration mode to configure NetFlow timeout parameters:
|
|
flow timeout active
seconds
Example:
switch(config)# flow timeout active 90
|
Sets the active timeout value in seconds. The range is from 60 to 4092. The default is 1800.
|
flow timeout aggressive threshold
percent
Example:
switch(config)# flow timeout aggressive threshold 90
|
Enables using a percentage that you want the NetFlow table to be before aggressive aging starts. The range is from 50 to 99. The default is disabled.
|
flow timeout fast
seconds
threshold
packets
Example:
switch(config)# flow timeout fast 40 threshold 1200
|
Enables using a fast timeout value and the number of packets in a flow before aging begins. The fast timeout range in seconds is from 32 to 512. The packet range is from 1 to 4000. The default is disabled.
|
flow timeout inactive
seconds
Example:
switch(config)# flow timeout inactive 900
|
Sets the inactive timeout value in seconds. The range is from 15 to 4092. The default is 15.
|
flow timeout session
Example:
switch(config)# flow timeout session
|
Enables TCP session aging. The default is disabled.
|