IP Flow Information Export (IPFIX) 315
Internet Protocol Flow Information Export (IPFIX) is an IETF standard export protocol (RFC 7011) for sending IP flow information. Cisco NCS 5000 Router supports IPFIX 315 format to export flow information. IPFIX 315 format facilitates sending ‘n’ octets frame information starting from ethernet header till trasport header of the traffic flow over the network. IPFIX 315 supports sending variable size packet record with variable payload information such as IPv4, IPv6, MPLS, and Nested packets like OuterIP-GRE-InnerIP etc. The process includes sampling and exporting the traffic flow information. Along with the ethernet frame information, IPFIX 315 format exports information of incoming and outgoing interface of the sampled packet.
The information of the packets flowing through a device is used for variety of purpose including network monitoring, capacity planning, traffic management, etc.
Cisco NCS 5000 Router does not support Netflow version 9 format to export flow information.
Sampling and Exporting Information
You must configure a sampling map to sample the traffic flow information. The sampler map specifies the rate at which packets (one out of n packets) are sampled. The minimun sampling rate is 1 out of 32,000 packets. Not all packets flowing through a device are exported; packets selected as per sampling rate are considered for exporting.
The size of exported packet depends on the sampled packet size and location of payload L4 header. The exported packet size is:
160 bytes, if the sampled packet size is more than 160 bytes and payload L4 header is not obtained within first 160 bytes
length of the sampled packet until the payload L4 header, if the payload L4 header is obtained within 160 bytes
equal to length of the packet, if packet size is less than 160 bytes and the payload L4 header is not obtained within first 160 bytes
The below figure IPFIX 315 Export Packet Format shows exported packet information.
A special cache type called Immediate Aging is used while exporting the packets. Immediate Aging ensures that the flows are exported as soon as they are added to the cache. Use the command cache immediate in flow monitor map configuration to enable Immediate Aging cache type.