Cisco IOS NetFlow Overview

NetFlow is a Cisco IOS application that provides statistics on packets flowing through the routing devices in the network. It is emerging as a primary network accounting and security technology.

NetFlow identifies packet flows for both ingress and egress IP packets. It does not involve any connection-setup protocol, either between routers or to any other networking device or end station. NetFlow does not require any change externally--either to the packets themselves or to any networking device. NetFlow is completely transparent to the existing network, including end stations and application software and network devices like LAN switches. Also, NetFlow capture and export are performed independently on each internetworking device; NetFlow need not be operational on each router in the network.

NetFlow is supported on IP and IP encapsulated traffic over most interface types and encapsulations. However, NetFlow does not support ATM LAN emulation (LANE) and does not support an Inter-Switch Link (ISL)/virtual LAN (VLAN), ATM, or Frame Relay interfaces when more than one input access control list (ACL) is used on the interface. Cisco 12000 IP Service Engine ATM line cards do not have this restriction when more than one input ACL is used on the interface.

You can display and clear NetFlow statistics. NetFlow statistics consist of IP packet size distribution data, IP flow switching cache information, and flow information. See the NetFlow Flows.

NetFlow captures a rich set of traffic statistics. These traffic statistics include user, protocol, port, and type of service (ToS) information that can be used for a wide variety of purposes such as network application and user monitoring, network analysis and planning, security analysis, accounting and billing, traffic engineering, and NetFlow data warehousing and data mining.

A NetFlow network flow is defined as a unidirectional stream of packets between a given source and destination. The source and destination are each defined by a network-layer IP address and transport-layer source and destination port numbers. Specifically, a flow is defined by the combination of the following seven key fields:

• Source IP address
• Destination IP address
• Source port number
• Destination port number
• Layer 3 protocol type
• Type of service (ToS)
• Input logical interface

These seven key fields define a unique flow. If a packet has one key field different from another packet, it is considered to belong to another flow. A flow might also contain other accounting fields (such as the AS number in the NetFlow export Version 5 flow format), depending on the export record version that you configure. Flows are stored in the NetFlow cache.

The key components of NetFlow are the NetFlow cache that stores IP flow information, and the NetFlow export or transport mechanism that sends NetFlow data to a network management collector, such as the NetFlow Collection Engine. NetFlow operates by creating a NetFlow cache entry (a flow record) for each active flow. NetFlow maintains a flow record within the cache for each active flow. Each flow record in the NetFlow cache contains fields that can later be exported to a collection device, such as the NetFlow Collection Engine.

NetFlow captures data from ingress (incoming) and egress (outgoing) packets. NetFlow gathers data for the following ingress IP packets:

• IP-to-IP packets
• IP-to-Multiprotocol Label Switching (MPLS) packets
• Frame Relay-terminated packets
• ATM-terminated packets

NetFlow captures data for all egress (outgoing) packets through the use of the following features:

• Egress NetFlow Accounting--NetFlow gathers data for all egress packets for IP traffic only.
• NetFlow MPLS Egress--NetFlow gathers data for all egress MPLS-to-IP packets.

NetFlow exports data in UDP datagrams in one of five formats: Version 9, Version 8, Version 7, Version 5, or Version 1. Version 9 export format, the latest version, is the most flexible and extensive format. Version 1 was the initial NetFlow export format; Version 7 is supported only on certain platforms, and Version 8 only supports export from aggregation cache. (Versions 2 through 4 and Version 6 were either not released or are not supported.)

• Version 9--A flexible and extensible format, which provides the versatility needed for support of new fields and record types. This format accommodates new NetFlow-supported technologies such as multicast, Multiprotocol Label Switching (MPLS), and Border Gateway Protocol (BGP) next hop. The distinguishing feature of the NetFlow Version 9 format is that it is template based. Templates provide a means of extending the record format, a feature that should allow future enhancements to NetFlow services without requiring concurrent changes to the basic flow-record format. Internet Protocol Information Export (IPFIX) was based on the Version 9 export format.
• Version 8--A format added to support data export from aggregation caches. Version 8 allows export datagrams to contain a subset of the usual Version 5 export data, if that data is valid for a particular aggregation cache scheme.
• Version 7--A version supported on Catalyst 6000 series switches with a Multilayer Switch Feature Card (MSFC) on CatOS Release 5.5(7) and later.

On Catalyst 6000 series switches with an MSFC, you can export using either the Version 7 or Version 8 format.

Information about and instructions for configuring NetFlow on Catalyst 6000 series switches is available in the Catalyst 6500 Series Switches documentation.

• Version 5--A version that adds BGP autonomous system (AS) information and flow sequence numbers.
• Version 1, the initially released export format, is rarely used today. Do not use the Version 1 export format unless the legacy collection system you are using requires it. Use either the Version 9 export format or the Version 5 export format for data export from the main cache.

For more information on a specific NetFlow data export format, see the "Configuring NetFlow and NetFlow Data Export" module.

The NetFlow application supports features that you can set up to further analyze network traffic data. NetFlow divides these features and services into the following three categories for processing:

• Preprocessing features that allow you to collect subsets of your network traffic data for analysis.
• Advanced features and services based on the flexible NetFlow Version 9 export format that allow you to collect data on types of traffic in addition to IP traffic.
• Postprocessing features that allow you to define fields that control how traffic data is exported.

You need to decide if you want to further analyze your network traffic. If you do want to do further analysis, you need to make choices in two areas:

• Do you want to customize or fine-tune the way that you collect NetFlow data? For example, you might want to configure packet sampling, or packet filtering, or an aggregation scheme.
• Do you want to collect and analyze data about the use of other Cisco IOS applications? For example, you might want to configure NetFlow support for BGP next hop, multicast, MPLS, or IPv6.

Before you configure or enable an additional NetFlow feature or service, you need to understand the prerequisites, restrictions, and key concepts that apply to each feature or service. Refer to the following sections for information about and links to the NetFlow features and services:

The table below briefly describes preprocessing features and indicates where you can find concept and task information about each. You set up these features to select the subset of traffic of interest to you before NetFlow processing begins.

The table below briefly describes advanced features and services supported by NetFlow and indicates where you can find concept and task information about each. Configure these features and services to collect and analyze NetFlow traffic statistics about them (features such as BGP Next Hop, multicast, and MPLS).

The table below briefly describes postprocessing features and indicates where you can find concept and task information about each. You configure these features to set up the export of NetFlow data.

The NetFlow MIB and the NetFlow MIB and Top Talkers features provide real time access to NetFlow cache information. These feature do not require a collector to obtain NetFlow data. This allows smaller enterprises to collect NetFlow data.

With the NetFlow MIB feature, you can access in real time the system information that is stored in the NetFlow cache by utilizing a MIB implementation based on the Simple Network Management Protocol (SNMP). This information is accessed by get and set commands entered on the network management system (NMS) workstation for which SNMP has been implemented. The NetFlow MIB feature provides MIB objects that allow you to monitor cache flow information, the current NetFlow configuration, and statistics. For details about the NetFlow MIB, see the "Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data" module.

The NetFlow MIB and Top Talkers feature uses NetFlow functionality to obtain information regarding heaviest traffic patterns and most-used applications in the network. You can use this feature for security monitoring or accounting purposes for top talkers, and matching and identifying addresses for key users of the network. You configure the criteria by which flows from the NetFlow cache are sorted and placed in a special cache. The flows that are displayed by this feature are known as "top talkers." For details about the NetFlow MIB and Top Talkers, see the "Configuring NetFlow Top Talkers using Cisco IOS CLI Commands or SNMP Commands" module.