Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for Flexible NetFlow
The following are prerequisites for your Flexible NetFlow configuration:
You must configure a source interface. If you do not configure a source interface, the exporter will remain in a disabled state.
You must configure a valid record name for every flow monitor.
The following are the prerequisites for wireless Flexible NetFlow:
Ensure that the networking device is running a Cisco release that supports wireless Flexible NetFlow.
Ensure that the target is connected to a WLAN.
The networking device must be configured to support protocol types such as IP, IPv6, and datalink.
Valid flow record and monitor are required before generating the flow.
The following are
restrictions for Flexible NetFlow:
NetFlow (TNF) accounting is not supported.
v5 export format is not supported, only NetFlow v9 export format is supported.
and egress NetFlow accounting is supported.
policing feature shares the NetFlow hardware resource with FNF.
Only one flow
monitor per interface and per direction is supported.
Layer 2, IPv4,
and IPv6 traffic types are supported; however, the
switch can apply a flow monitor to only one
of these types at a time for a given direction and interface.
Layer 2, VLAN,
WLAN and Layer 3 interfaces are supported, but the
switch does not support SVI and tunnels.
NetFlow table sizes are supported:
Ingress NetFlow Table
Depending on the switch type, a switch will have one or two
forwarding ASICs. The capacities listed in the above table are on a per-ASIC
The switch can
support either one or two ASICs. Each ASIC has 8K ingress and 16 K egress
The NetFlow tables are on separate compartments and
cannot be combined. Depending on which ASIC processed the packet, the flows
will be created in the table in the corresponding ASIC.
Both full flow
accounting and sampled NetFlow accounting are supported.
implementation supports four hardware samplers. You can select a sampler rate
from 1 out of 2 to 1 out of 1024. Only random sampling mode is supported.
microflow policing feature (which is enabled only for wireless implementation),
NetFlow can and should be used only in full flow mode i.e. NetFlow policing
cannot be used. For wireless traffic, applying a sampler is not permitted, as
it hinders microflow QoS.
flow accounting is supported for wireless traffic.
uses hash tables internally. Hash collisions can occur in the hardware.
Therefore, in spite of the internal overflow Content Addressable Memory (CAM),
the actual NetFlow table utilization could be about 80 percent.
what fields are used for the flow, a single flow could take two consecutive
entries. IPv6 flows also take two entries. In these situations, the effective
usage of NetFlow entries is half the table size, which is separate from the
above hash collision limitation.
switch supports up to 16 flow monitors.
policing uses a separate set of flow monitors (limit 3).
NetFlow accounting is supported. SSID is treated in a manner similar to an
interface. However, certain fields are not supported (such as AP MAC address
and user ID ).
format NetFlow export is supported.
The NetFlow software implementation supports
distributed NetFlow export, so the flows are exported from the same
switch in which the flow was created.
are present in the ASIC that first received the packets for the flow. Egress
flows are present in the ASIC from which the packets actually left the
switch set up.
value for the bytes count field (called “bytes long”) is Layer-2-packet-size—18
bytes. For classic Ethernet traffic (802.3), this will be accurate. For all
other Ethernet types, this field will not be accurate. Use the "bytes layer2”
field, which always reports the accurate Layer 2 packet size. For information
about supported Flexible NetFlow fields, see
Supported Flexible NetFlow Fields.
Information About NetFlow
NetFlow is a Cisco technology that provides statistics on packets flowing through the switch. NetFlow is the standard for acquiring IP operational data from IP networks. NetFlow provides data to enable network and security monitoring, network planning, traffic analysis, and IP accounting. Flexible NetFlow improves on original NetFlow by adding the capability to customize the traffic analysis parameters for your specific requirements. Flexible NetFlow facilitates the creation of more complex configurations for traffic analysis and data export through the use of reusable configuration components.
Flexible NetFlow uses flows to provide statistics for accounting, network monitoring, and network planning.
A flow is a unidirectional stream of packets that arrives on a source interface and has the same values for the keys. A key is an identified value for a field within the packet. You create a flow using a flow record to define the unique keys for your flow.
The switch supports the Flexible NetFlow feature that enables enhanced network anomalies and security detection. Flexible NetFlow allows you to define an optimal flow record for a particular application by selecting the keys from a large collection of predefined fields.
All key values must match for the packet to count in a given flow. A flow might gather other fields of interest, depending on the export record version that you configure. Flows are stored in the Flexible NetFlow cache.
You can export the data that Flexible NetFlow gathers for your flow by using an exporter and export this data to a remote Flexible NetFlow collector.
You define the size of the data that you want to collect for a flow using a monitor. The monitor combines the flow record and exporter with the Flexible NetFlow cache information.
The wireless Flexible NetFlow infrastructure supports the following:
Flexible NetFlow Version 9.0
User-based rate limiting
Voice and video flow monitoring
Reflexive access control list (ACL)
Microflow Policing and User-Based Rate Limiting
Microflow policing associates a 2-color 1-rate policer and related drop statistics to each flow present in the NetFlow table. When the flow mask comprises all packet fields, this functionality is known as microflow policing. When the flow mask comprises either source or destination only, this functionality is known as user-based rate limiting.
Voice and Video Flow Monitoring
Voice and video flows are full flow mask-based entries. The ASIC provides the flexibility to program the policer parameters, share policers across multiple flows and rewrite the IP address and Layer 4 port numbers of these flows.
For dynamic entries, the NetFlow engine will use the policer parameters that are derived for the flow based on the policy (ACL/QoS-based policies). Dynamic entries cannot share policer across multiple flows.
Reflexive ACLs allow IP packets to be filtered based on upper-layer session information. The ACLs allow outbound traffic and limit inbound traffic in response to the sessions that originate inside the trusted network. The reflexive ACLs are transparent to the filtering mechanism until a data packet that matches the reflexive entry activates it. At this time, a temporary ACL entry is created and added to the IP-named access lists. The information obtained from the data packet to generate the reflexive ACL entry is permit/deny bit, the source IP address and port, the destination IP address, port, and the protocol type. During reflexive ACL entry evaluation, if the protocol type is either TCP or UDP, then the port information must match exactly. For other protocols, there is no port information to match. After this ACL is installed, the firewall is then opened for the reply packets to pass through. At this time, a potential hacker could have access to the network behind the firewall. To narrow this window, an idle timeout period can be defined. However, in the case of TCP, if two FIN bits or an RST is detected, the ACL entry can be removed.
A flow record defines
the keys that Flexible NetFlow uses to identify packets in the flow, as well as
other fields of interest that Flexible NetFlow gathers for the flow. You can
define a flow record with any combination of keys and fields of interest. The
switch supports a rich set of keys. A flow
record also defines the types of counters gathered per flow. You can configure
64-bit packet or byte counters. The
switch enables the following match fields as
the defaults when you create a flow record:
This example shows how to create a flow and apply it to an interface:
Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# flow export export1Switch(config-flow-exporter)# destination 10.0.101.254Switch(config-flow-exporter)# transport udp 2055Switch(config-flow-exporter)# exitSwitch(config)# flow record record1Switch(config-flow-record)# match ipv4 source addressSwitch(config-flow-record)# match ipv4 destination addressSwitch(config-flow-record)# match ipv4 protocolSwitch(config-flow-record)# match transport source-portSwitch(config-flow-record)# match transport destination-portSwitch(config-flow-record)# collect counter byte longSwitch(config-flow-record)# collect counter packet longSwitch(config-flow-record)# collect timestamp absolute firstSwitch(config-flow-record)# collect timestamp absolute lastSwitch(config-flow-record)# exitSwitch(config)# flow monitor monitor1Switch(config-flow-monitor)# record record1Switch(config-flow-monitor)# exporter export1Switch(config-flow-monitor)# exitSwitch(config)# interface tenGigabitEthernet 1/0/1Switch(config-if)# ip flow monitor monitor1 inputSwitch(config-if)# end
Example: Configuring IPv4 Flexible NetFlow in WLAN (Ingress Direction)
The following example shows how to configure IPv4 Flexible NetFlow on WLAN ingress direction:
Switch# configure terminalSwitch(config)# flow record fr_v4Switch(config-flow-record)# match ipv4 destination addressSwitch(config-flow-record)# match ipv4 source addressSwitch(config-flow-record)# match ipv4 protocolSwitch(config-flow-record)# match ipv4 tosSwitch(config-flow-record)# match ipv4 ttlSwitch(config-flow-record)# match ipv4 versionSwitch(config-flow-record)# match wireless ssidSwitch(config-flow-record)# collect wireless ap mac addressSwitch(config-flow-record)# collect counter packets longSwitch(config-flow-record)# collect counter bytes longSwitch(config-flow-record)# collect timestamp absolute firstSwitch(config-flow-record)# collect timestamp absolute lastSwitch(config-flow-record)# exitSwitch(config)# flow monitor fm_v4Switch(config-flow-monitor)# record fr_v4Switch(config-flow-record)# exitSwitch(config)# wlan 1Switch(config-wlan)# ip flow monitor fm_v4 inSwitch(config-wlan)# endSwitch# show flow monitor fm_v4 cache
Example: Configuring IPv6 and Transport Flag Flexible NetFlow in WLAN (Egress Direction)
The following example shows how to configure IPv6 and transport flag Flexible NetFlow on WLAN egress direction:
Switch# configure terminalSwitch(config)# flow record fr_v6Switch(config-flow-record)# match ipv6 destination addressSwitch(config-flow-record)# match ipv6 source addressSwitch(config-flow-record)# match ipv6 hop-limitSwitch(config-flow-record)# match ipv6 protocolSwitch(config-flow-record)# match ipv6 trafficSwitch(config-flow-record)# match ipv6 versionSwitch(config-flow-record)# match wireless ssidSwitch(config-flow-record)# collect wireless ap mac addressSwitch(config-flow-record)# collect counter bytes longSwitch(config-flow-record)# collect transport tcp flagsSwitch(config-flow-record)# exitSwitch(config)# flow monitor fm_v6Switch(config-flow-monitor)# record fr_v6Switch(config-flow-monitor)# exitSwitch(config)# wlan 1Switch(config-wlan)# ipv6 flow monitor fm_v6 outSwitch(config-wlan)# endSwitch# show flow monitor fm_v6 cache
On the switch, you cannot specify which TCP flag to collect. You can only specify to collect transport TCP flags.
Support website provides extensive online resources, including documentation
and tools for troubleshooting and resolving technical issues with Cisco
products and technologies.
security and technical information about your products, you can subscribe to
various services, such as the Product Alert Tool (accessed from Field Notices),
the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS)
most tools on the Cisco Support website requires a Cisco.com user ID and