- Introduction
- Installation Prerequisites
- Controller Installation
- Controller and Agent Communications
- Network Element Configuration
- Virtual Service Install Script
- Agent Management
- Initial Learning Phase
- Next Steps
- Logging Configuration
- pxGrid Integration
- Controller Database Cleanup
- Additional Controller Configuration
- NetFlow Configuration Overview
- Troubleshooting
- Uninstallation
Cisco Stealthwatch Learning Network License Virtual Service Installation Guide
- Updated:
- July 13, 2016
Chapter: NetFlow Configuration Overview
NetFlow Configuration Overview
The following describes the Flexible NetFlow configuration performed by the installation_auto.py install script.
NetFlow Configuration
To capture information about traffic traversing your network, as you deploy agents to your network, the system configures the following Flexible NetFlow components in order:
-
SLN-NF-RECORD - a NetFlow flow record which defines key fields to match traffic, and non-key fields to collect
-
SLN-NF-EXPORTER - a NetFlow flow exporter that references the agent Management and Control IP address to send NetFlow data to the agent
-
SLN-NF-MONITOR - a NetFlow flow monitor that references SLN-NF-RECORD to monitor input and output traffic coming over configured branch interfaces, and forwards it to SLN-NF-EXPORTER
The following diagram illustrates NetFlow operation on the ISR.
As input and output traffic passes over the branch facing interfaces, the SLN-NF-MONITOR flow monitor, referencing the SLN-NF-RECORD flow record, monitors the traffic for the key fields. It collects the non-key fields defined in the flow record. The flow monitor sends the flow record to the SLN-NF-EXPORTER flow exporter, which then sends it to the configured virtual service eth0 Management and Control IP address.
NetFlow Configuration Fields
Flow Record
The following describes the fields configured for the SLN-NF-RECORD flow record.
|
Configured Field |
Description |
|---|---|
|
match ipv4 protocol |
Configures the flow protocol as a key field to match on. |
|
match ipv4 source address |
Configures the flow source IPv4 address as a key field to match on. |
|
match ipv4 destination address |
Configures the flow destination IPv4 address as a key field to match on. |
|
match transport source-port |
Configures the flow source port as a key field to match on. |
|
match transport destination-port |
Configures the flow destination port as a key field to match on. |
|
collect datalink mac source address input |
Configures the source MAC address received on an input interface as a nonkey field to collect. |
|
collect datalink mac destination address output |
Configures the destination MAC address transmitted on an output interface as a nonkey field to collect. |
|
collect transport tcp flags |
Configures the TCP flags as a nonkey field to collect. |
|
collect interface input |
Configures the router interfaces on which a packet entered the router as a nonkey field to collect. |
|
collect interface output |
Configures the router interfaces on which a packet exited the router as a nonkey field to collect. |
|
collect flow direction |
Configures the flow direction as a nonkey field to collect. |
|
collect counter bytes |
Configures the total number of bytes in the flow as a nonkey field to collect. |
|
collect counter packets |
Configures the total number of packets in the flow as a nonkey field to collect. |
|
collect timestamp sys-uptime first |
Configures the first time the system saw a packet in a flow as a nonkey field to collect. |
|
collect timestamp sys-uptime last |
Configures the last time the system saw a packet in a flow as a nonkey field to collect. |
|
collect application name |
Configures the name of the application used in the flow as a nonkey field to collect. |
|
collect routing forwarding-status |
Configures the packet forwarding status as a nonkey field to collect. |
Flow Exporter
The following describes the fields configured for the SLN-NF-EXPORTER flow record.
|
Configured Field |
Description |
|---|---|
|
destination <dla-ip-address> |
Configures the IP address to which the exporter will send flow records. |
|
transport udp 6666 |
Configures the UDP port on which the destination host listens for UDP traffic. |
|
template data timeout 60 |
Configures sending the flow record template every 300 seconds. |
Flow Monitor
The following describes the fields configured for the SLN-NF-MONITOR flow monitor.
|
Configured Field |
Description |
|---|---|
|
exporter SLN-NF-EXPORTER |
Associates the monitor with the SLN-NF-EXPORTER flow exporter you created. |
|
cache timeout active 60 |
Configures the cache timeout for active flows at 60 seconds. |
|
cache entries 512000 |
Configures the cache to store a maximum of 512000 flows. |
|
record SLN-NF-RECORD |
Associates the monitor with the SLN-NF-RECORD flow record you created. |
Feedback