Flexible Netflow Concepts and Configuration

In modern networks, there is a need to compile and maintain a good set of traffic records for a number of different purposes. These purposes include the ability to monitor network traffic for network planning, security and analysis as well as track traffic usage for billing purposes. To provide this ability, Cisco developed the Netflow feature; the Netflow feature was then extended to provide further configuration flexibility and the Flexible Netflow feature was created. This article takes a look at the typical uses for the Flexible Netflow feature, how it works, and how it can be configured into a complete solution.

Flexible Netflow Concepts

There are a number of different uses for a traffic statistics feature when dealing with modern networks; the Flexible Netflow feature can provide a solution for a number of different tasks, including those shown in Table 1 below:

Table 1—Typical Netflow Uses

Netflow Components

The basic concept with Flexible Netflow (and the Original Netflow) is to categorize and track different traffic flows.

Records

These flows are defined by a number of different pieces of traffic information; the information used when using Flexible Netflow can be defined by user records or within standard records. With the original Netflow, a flow was defined by seven different pieces of information that is used to categorize traffic; this information includes the following fields:

• Source IP address
• Destination IP address
• Source port number
• Destination port number
• Layer 3 protocol type
• Type of service (ToS)
• Input logical interface

Traffic with the same values for these seven fields was defined as a flow and individually tracked. Flexible Netflow provides the ability to either use this original flow definition (“Record”) or to create a new, more specific flow definition. When creating a user-defined flow definition, the fields that are going to be tracked are selected and then defined as either a key field or as a nonkey field; these key fields are then used by Flexible Netflow to define traffic flows; the fields that are defined as nonkey are captured with the flow but are not used to define specific flows.

Flow Monitor

The Netflow flow monitor component is used to provide the actual traffic monitoring on a configured interface. When a flow monitor is applied to an interface, a flow monitor cache is created that is used to collect the traffic based on the key and nonkey fields in the configured record. There are three different modes of flow monitor cache that can be used with each flow monitor:

• Layer 3—When in the normal mode, cache entries are aged out according to timeout parameters, based on the activity of a flow. This is the default mode.
• Immediate—When in the immediate mode, cache entries are aged out as soon as created. When in this mode, each flow contains only one packet; this is used when traffic information is required immediately at the flow export destination (see next section).
• Permanent—When in the permanent mode, cache entries that are newer are aged out. This is useful when long term statistics on a device are required and the number of flows is expected to be low.

Flow Exporter

A flow exporter is used to transfer the contents of the Netflow cache from the device to a remote system. The Netflow Data Export Format Version 9 is used with Flexible Netflow (as opposed to Version 5) in order to provide additional flexibility. Multiple flow exporters can be configured and assigned to a variety of different flow monitors if there is a need to export to multiple locations.

Flow Sampler

A flow sampler is used when there is a high volume of traffic to analyze that could potentially affect the performance of the monitored device. In this situation, a flow sampler can be used to limit the number of packets that will be analyzed by the flow monitor. For example, 1 out of every 2 packets could be captured and analyzed.

Flexible Netflow Configuration

The exact configuration that is required to setup Flexible Netflow depends on whether a flow exporter is going to be used and whether a flow sampler is required to be configured. The steps required to setup a basic Flexible Netflow exporter configuration are shown in Table 2 below:

Table 2—Flow Exporter Configuration

The steps required to setup a basic Flexible Netflow sampler configuration are shown in Table 3 below (for application, see the flow monitor configuration):

Table 3—Flow Sampler Configuration

The steps required to setup a basic Flexible Netflow monitor configuration are shown in Table 4 below:

Table 4—Flow Monitor Configuration

Summary

The Flexible Netflow feature provides a solution for a number of different needs within an organization. With little investment in time and resources, the Flexible Netflow feature can save an organization money, provide better accounting of organizational traffic, and provide a solution that can help solve a number of different problems within an organizational network. Hopefully, the information in this article can be used to become familiar with the Flexible Netflow feature as well as help with initial feature configuration.