NetFlow identifies packet flows for ingress IP packets and provides statistics based on these packet flows. NetFlow does not require any change to either the packets themselves or to any networking device.
NetFlow uses flows to provide statistics for accounting, network monitoring, and network planning. A flow is a unidirectional stream of packets that arrives on a source interface (or VLAN) and has the same values for the keys. A key is an identified value for a field within the packet. You create a flow using a flow record to define the unique keys for your flow.
Cisco NX-OS supports the flexible NetFlow feature that enables enhanced network anomalies and security detection. Flexible NetFlow allows you to define an optimal flow record for a particular application by selecting the keys from a large collection of predefined fields.
All key values must match for the packet to count in a given flow. A flow might gather other fields of interest, depending on the export record version that you configure. Flows are stored in the NetFlow cache.
You can export the data that NetFlow gathers for your flow by using a flow exporter and export this data to a remote NetFlow Collector, such as Cisco Stealthwatch. Cisco NX-OS exports a flow as part of a NetFlow export User Datagram Protocol (UDP) datagram under the following circumstances:
Flows are exported periodically as per the flow timeout value, which defaults to 10 seconds if not configured.
You have forced the flow to export.
The flow record determines the size of the data to be collected for a flow. The flow monitor combines the flow record and flow exporter with the NetFlow cache information.
Cisco NX-OS can gather NetFlow statistics and analyze all packets on the interface or subinterface.
Dual-Layer NetFlow Implementation
Unlike other Cisco Nexus platforms, Cisco Nexus 9000 Series switches separate NetFlow processing into two layers:
The first layer supports per-packet visibility for line-rate traffic. Packets do not need to be sampled and statistically analyzed. Instead, the packets can be processed and aggregated at line rate.
The second layer enables the gathering of flows at scale. It can maintain hundreds of thousands of flows without losing any flows and periodically exports them to an external collector.
A flow record defines the keys that NetFlow uses to identify packets and other fields of interest that NetFlow gathers for the flow. You can define a flow record with any combination of keys and fields of interest. Cisco NX-OS supports a rich set of keys. A flow record also defines the types of counters gathered per flow. You can configure 32- or 64-bit packet or byte counters.
The key fields are specified with the match keyword. The fields of interest and counters are specified under the collect keyword.
Cisco NX-OS enables the following match fields as the defaults when you create a flow record:
match interface input
match flow direction
A flow exporter contains network layer and transport layer details for the NetFlow export packet. You can configure the following information in a flow exporter:
Export destination IP address
UDP port number (where the NetFlow Collector is listening for NetFlow packets)—The default value is 9995.
NetFlow export packets use the IP address that is assigned to the source interface. If the source interface does not have an IP address assigned to it, the flow exporter drops flows that were meant to be exported.
Cisco NX-OS exports data to the NetFlow Collector whenever a timeout occurs. You can configure a flush cache timeout (using the flow timeout command) to flush the cache and force a flow export.
Cisco NX-OS supports the Version 9 export format. This format supports a more efficient network utilization than the older Version 5 export format and supports IPv6 and Layer 2 fields. In addition, the Version 9 export format supports the full 32-bit SNMP ifIndex values at the NetFlow Collector.
Layer 2 NetFlow Keys
You can define Layer 2 keys in flexible NetFlow records that you can use to capture flows in Layer 2 interfaces. The Layer 2 keys are as follows:
Source and destination MAC addresses
Source VLAN ID
EtherType from the Ethernet frame
You can apply Layer 2 NetFlow to the following interfaces for the ingress direction:
Switch ports in access mode
Switch ports in trunk mode
Layer 2 port channels
You cannot apply Layer 2 NetFlow to VLANs, egress interfaces, or Layer 3 interfaces such as VLAN interfaces.
A flow monitor references the flow record and flow exporter. You apply a flow monitor to an interface.
NetFlow Output Interface
The NetFlow output interface on Cisco Nexus 9300-FX and Cisco Nexus 9500 platform switches with FM-E and FM-E2 modules have the following features.
NetFlow in the show flow cache command displays
output_if_id and exports output interface to the collector on Cisco Nexus 9300-FX and 9500 platform switches with N9K-X9700-FX line cards.
The NetFlow output interface for Cisco Nexus 9300-FX switches supports both IPv4 and IPv6 traffic flows. The NetFlow output
interface for Cisco Nexus 9500 platform switches is supported only for IPv4 traffic flows and is not supported for IPv6 traffic
flows. The show flow cache command displays
NetFlow supports exporting output interface to the collector for IPv4/IPv6 incoming traffic flows, which have Next-Hop as
destination interface. The NetFlow export format for
OutputInt support the full 32-bit SNMP
ifIndex values at the NetFlow Collector.
The NetFlow output interface is not supported for tunnel traffic flows such as MPLS, VXLAN, and GRE.
For more information on examples for NetFlow output interface, see the Display Example for NetFlow.
Cisco NX-OS supports stateful restarts for NetFlow. After a reboot, Cisco NX-OS applies the running configuration.
The flow cache is not preserved across restarts, and packets that come to the software during restarts cannot be processed.