In Flexible NetFlow a combination of key and nonkey fields is called a record. Flexible NetFlow records are assigned to Flexible NetFlow flow monitors to define the cache that is used for storing flow data.

A flow record defines the keys that Flexible NetFlow uses to identify packets in the flow, as well as other nonkey fields of interest that Flexible NetFlow gathers for the flow. You can define a flow record with any combination of keys and fields of interest. The switch supports a rich set of keys. A flow record also defines the types of counters gathered per flow. You can configure 64-bit packet or byte counters. The switch enables the following match fields as the defaults when you create a flow record:

• match datalink—Layer 2 attributes

• match ipv4—IPv4 attributes

• match ipv6—IPv6 attributes

• match transport—Transport layer fields

• match wireless—Wireless fields

Flow exporters export the data in the flow monitor cache to a remote system, such as a server running NetFlow collector, for analysis and storage. Flow exporters are created as separate entities in the configuration. Flow exporters are assigned to flow monitors to provide data export capability for the flow monitors. You can create several flow exporters and assign them to one or more flow monitors to provide several export destinations. You can create one flow exporter and apply it to several flow monitors.

NetFlow Data Export Format Version 9

The basic output of NetFlow is a flow record. Several different formats for flow records have evolved as NetFlow has matured. The most recent evolution of the NetFlow export format is known as Version 9. The distinguishing feature of the NetFlow Version 9 export format is that it is template-based. Templates provide an extensible design to the record format, a feature that should allow future enhancements to NetFlow services without requiring concurrent changes to the basic flow-record format. Using templates provides several key benefits:

• Third-party business partners who produce applications that provide collector or display services for NetFlow do not have to recompile their applications each time a new NetFlow feature is added. Instead, they should be able to use an external data file that documents the known template formats.

• New features can be added to NetFlow quickly without breaking current implementations.

• NetFlow is “future-proofed” against new or developing protocols because the Version 9 format can be adapted to provide support for them.

The Version 9 export format consists of a packet header followed by one or more template flow or data flow sets. A template flow set provides a description of the fields that will be present in future data flow sets. These data flow sets may occur later within the same export packet or in subsequent export packets. Template flow and data flow sets can be intermingled within a single export packet, as illustrated in the figure below.

Figure 2. Version 9 Export Packet

NetFlow Version 9 will periodically export the template data so the NetFlow collector will understand what data is to be sent and also export the data flow set for the template. The key advantage to Flexible NetFlow is that the user configures a flow record, which is effectively converted to a Version 9 template and then forwarded to the collector. The figure below is a detailed example of the NetFlow Version 9 export format, including the header, template flow, and data flow sets.

Figure 3. Detailed Example of the NetFlow Version 9 Export Format

For more information on the Version 9 export format, refer to the white paper titled Cisco IOS NetFlow Version 9 Flow-Record Format, available at this URL: http:/​/​www.cisco.com/​en/​US/​tech/​tk648/​tk362/​technologies_​white_​paper09186a00800a3db9.shtml.

Flow monitors are the Flexible NetFlow component that is applied to interfaces to perform network traffic monitoring.

Flow monitors consist of a user-defined record, an optional flow exporter, and a cache that is automatically created at the time the flow monitor is applied to the first interface.

Flow data is collected from the network traffic and added to the flow monitor cache during the monitoring process based on the key and nonkey fields in the flow record.

Flexible NetFlow can be used to perform different types of analysis on the same traffic. In the figure below, packet 1 is analyzed using a record designed for standard traffic analysis on the input interface and a record designed for security analysis on the output interface.

Figure 4. Example of Using Two Flow Monitors to Analyze the Same Traffic

The figure below shows a more complex example of how you can apply different types of flow monitors with custom records.

Figure 5. Complex Example of Using Multiple Types of Flow Monitors with Custom Records

Flow samplers are created as separate components in a router’s configuration. Flow samplers are used to reduce the load on the device that is running Flexible NetFlow by limiting the number of packets that are selected for analysis.

Flow sampling exchanges monitoring accuracy for router performance. When you apply a sampler to a flow monitor, the overhead load on the router of running the flow monitor is reduced because the number of packets that the flow monitor must analyze is reduced. The reduction in the number of packets that are analyzed by the flow monitor causes a corresponding reduction in the accuracy of the information stored in the flow monitor’s cache.

Samplers are combined with flow monitors when they are applied to an interface with the ip flow monitor command.

1.    enable


2.    configure terminal


3.    flow record record-name


4.    description description


5.    match {ipv4 | ipv6} {destination | source} address


• or

  match datalink {destination-vlan-id | dot1q | ethertype |mac|source-vlan-id}

• or

  match transport {icmp | igmp | source-port |tcp|udp}

6.    Repeat Step 5 as required to configure additional key fields for the record.

7.    collect interface {input | output}


• or

  collect counter {bytes [ exported | long] flows [exported]|packets} [ exported | long]

• or

  collect timestamp sys-uptime {first | last}

8.    Repeat the above step as required to configure additional nonkey fields for the record.

9.    end


10.    show flow record record-name


11.    show running-config flow record record-name

Device> enable

Device# configure terminal

Device(config)# flow record FLOW-RECORD-1

Device(config-flow-record)# description Used for basic traffic analysis

Device(config-flow-record)# match ipv4 destination address

Device(config-flow-record)# collect interface input

Device(config-flow-record)# end

Device# show flow record FLOW_RECORD-1

Device# show running-config flow record FLOW_RECORD-1 

You can create a flow export to define the export parameters for a flow.

Note	Each flow exporter supports only one destination. If you want to export the data to multiple destinations, you must configure multiple flow exporters and assign them to the flow monitor. You can export to a destination using IPv4 address.

1.    configure terminal


2.    flow exporter name


3.    description string


4.    destination {hostname | ipv4-address} [ vrf vrf-name]


5.    dscp value


6.    source {interface-id }


7.    option {exporter-stats | interface-table | sampler-table} [timeout seconds]


8.    template data timeout seconds


9.    transport udp number


10.    ttl seconds


11.    export-protocol {netflow-v9}


12.    end


13.    show running-config flow exporter exporter-name


14.    show flow exporter [name record-name]


15.    copy running-config startup-config

Switch# configure terminal

Switch(config)# flow exporter ExportTest

Switch(config-flow-exporter)# description ExportV9

Switch(config-flow-exporter)# destination 192.0.2.1 (IPv4 destination)

Switch(config-flow-exporter)# dscp 0

Switch(config-flow-exporter)# source gigabitEthernet1/0/1

Switch

Switch

Switch(config-flow-exporter)# transport udp 200

Switch(config-flow-exporter)# ttl 210

Switch(config-flow-exporter)# export-protocol netflow-v9

Switch(config-flow-record)#  end

Switch# show running-config flow exporter ExportTest

Switch show flow exporter ExportTest 

Switch# copy running-config 
startup-config

Define a flow monitor based on the flow record and flow exporter.

Before You Begin

If you want to use a customized record, you must create the customized record before you can perform this task. If you want to add a flow exporter to the flow monitor for data export, you must create the exporter before you can complete this task.

Note

You must use the no ip flow monitor command to remove a flow monitor from all of the interfaces to which you have applied it before you can modify the parameters for the record command on the flow monitor. For information about the ip flow monitor command, refer to the Cisco IOS Flexible NetFlow Command Reference.

1.    enable


2.    configure terminal


3.    flow monitor monitor-name


4.    description description


5.    record {record-name}


6.    cache {timeout {active} seconds | type { normal }


7.    Repeat Step 6 as required to finish modifying the cache parameters for this flow monitor.

8.    exporter exporter-name


9.    end


10.    show flow monitor [[name] monitor-name [cache [format {csv | record | table}]] ]


11.    show running-config flow monitor monitor-name


12.    copy running-config startup-config

Switch> enable

Switch# configure terminal

Switch(config)# flow monitor FLOW-MONITOR-1

Switch(config-flow-monitor)# description Used for basic ipv4 traffic analysis

Switch(config-flow-monitor)# record FLOW-RECORD-1

Device(config-flow-monitor)# cache type normal

Switch(config-flow-monitor)# exporter EXPORTER-1 

Switch(config-flow-monitor)# end

Switch# show flow monitor FLOW-MONITOR-2 cache

Switch# show running-config flow monitor FLOW_MONITOR-1

Switch# copy running-config 
startup-config

1.    enable


2.    configure terminal


3.    sampler sampler-name


4.    description description


5.    mode {random} 1 out-of window-size


6.    exit


7.    interface type number


8.    {ip | ipv6} flow monitor monitor-name [[sampler] sampler-name] {input | output}

9.    end


10.    show sampler sampler-name

Device> enable

Device# configure terminal

Device(config)# sampler SAMPLER-1

Device(config-sampler)# description Sample at 50%

Device(config-sampler)# mode random 1 out-of 2 

Device(config-sampler)# exit

Device(config)# interface GigabitEthernet 0/0/0

Device(config-if)# ip flow monitor FLOW-MONITOR-1 sampler SAMPLER-1 input

Device(config-if)# end

Device# show sampler SAMPLER-1

1.    configure terminal


2.    interface type


3.    {ip flow monitor | ipv6 flow monitor}name [layer2-switched|multicast|sampler|unicast name] { input}


4.    end


5.    show flow interface [interface-type number]


6.    copy running-config startup-config

Switch# configure terminal

Switch(config)# interface GigabitEthernet1/0/1

Switch(config-if)# ip flow monitor MonitorTest input

Switch(config-flow-monitor)#  end

Switch# show flow interface

Switch# copy running-config 
startup-config