NetFlow Configuration Guide, Cisco IOS Release 12

1y ago
19 Views
2 Downloads
1.71 MB
204 Pages
Last View : 17d ago
Last Download : 4m ago
Upload by : Abby Duckworth
Transcription

NetFlow Configuration Guide, Cisco IOSRelease 12.2SXAmericas HeadquartersCisco Systems, Inc.170 West Tasman DriveSan Jose, CA 95134-1706USAhttp://www.cisco.comTel: 408 526-4000800 553-NETS (6387)Fax: 408 527-0883

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPEDWITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITEDWARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain versionof the UNIX operating system. All rights reserved. Copyright 1981, Regents of the University of California.NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALLFAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OFMERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADEPRACTICE.IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO ORITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL:www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationshipbetween Cisco and any other company. (1110R)Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output,network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative contentis unintentional and coincidental. 2011 Cisco Systems, Inc. All rights reserved.

CONTENTSCisco IOS NetFlow Overview 1Finding Feature Information 1Information About Cisco IOS NetFlow 1The NetFlow Application 2NetFlow Benefits Monitoring Analysis and Planning Security and Accounting and Billing 2NetFlow Cisco IOS Packaging Information 3NetFlow Flows 3NetFlow Main Cache Operation 4NetFlow Data Capture 4NetFlow Export Formats 4NetFlow Operation Processing Order of NetFlow Features 5NetFlow Preprocessing Features Filtering and Sampling 5NetFlow Advanced Features and Services BGP Next Hop Multicast MPLS NetFlow Layer 2 6NetFlow Postprocessing Features Aggregation Schemes and Export to Multiple Destinations 7NetFlow MIBs 7How to Configure Cisco IOS NetFlow 7Configuration Examples for Cisco IOS NetFlow 8Where to Go Next 8Additional References 8Glossary 10Getting Started with Configuring Cisco IOS NetFlow and NetFlow Data Export 13Finding Feature Information 13Prerequisites for Configuring NetFlow and NetFlow Data Export 14Restrictions for Configuring NetFlow and NetFlow Data Export 14NetFlow Data Capture 14NetFlow Data Export 15Information About Configuring NetFlow and NetFlow Data Export 15NetFlow Data Capture 15NetFlow Flows Key Fields 16NetFlow Configuration Guide, Cisco IOS Release 12.2SXiii

ContentsNetFlow Data Export Using the Version 9 Export Format 16How to Configure NetFlow and NetFlow Data Export 16Configuring NetFlow and NetFlow Data Export Using the Version 9 Export Format 16Verifying That NetFlow Is Operational and View NetFlow Statistics 18Verifying That NetFlow Data Export Is Operational 21Configuration Examples for Configuring NetFlow and NetFlow Data Export 21Example Configuring Egress NetFlow Accounting 21Example Configuring NetFlow Subinterface Support 22Example Configuring NetFlow Multiple Export Destinations 22Example Configuring NetFlow and NetFlow Data Export Using the Version 9 ExportFormat 22Example Configuring NetFlow for Analyzing PPPoE Session Traffic 23Additional References 23Feature Information for Configuring NetFlow and NetFlow Data Export 25Glossary 27Configuring NetFlow and NetFlow Data Export 29Finding Feature Information 29Prerequisites for Configuring NetFlow and NetFlow Data Export 29Restrictions for Configuring NetFlow and NetFlow Data Export 30NetFlow Data Capture 30NetFlow Data Export 31Information About Configuring NetFlow and NetFlow Data Export 31NetFlow Data Capture 32NetFlow Flows Key Fields 32NetFlow Cache Management and Data Export 32NetFlow Export Format Versions 9 8 5 and 1 33Overview 34Details 34NetFlow Export Version Formats 34NetFlow Export Packet Header Format 35NetFlow Flow Record and Export Format Content Information 36NetFlow Data Export Format Selection 40NetFlow Version 9 Data Export Format 41NetFlow Version 8 Data Export Format 43NetFlow Version 5 Data Export Format 44NetFlow Configuration Guide, Cisco IOS Release 12.2SXiv

ContentsNetFlow Version 1 Data Export Format 46Egress NetFlow Accounting Benefits NetFlow Accounting Simplified 46NetFlow Subinterface Support Benefits Fine-Tuning Your Data Collection 48NetFlow Multiple Export Destinations Benefits 48NetFlow on a Distributed VIP Interface 48How to Configure NetFlow and NetFlow Data Export 48Configuring NetFlow 48Verifying that NetFlow Is Operational and Displaying NetFlow Statistics 50Configuring NetFlow Data Export Using the Version 9 Export Format 52Verifying that NetFlow Data Export Is Operational 55Clearing NetFlow Statistics on the Router 56Customizing the NetFlow Main Cache Parameters 57NetFlow Cache Entry Management on a Routing Device 57NetFlow Cache Size 58Configuration Examples for Configuring NetFlow and NetFlow Data Export 61Example Configuring Egress NetFlow Accounting 61Example Configuring NetFlow Subinterface Support 61NetFlow Subinterface Support for Ingress (Received) Traffic on a Subinterface 61NetFlow SubInterface Support for Egress (Transmitted) Traffic on a Subinterface 61Example Configuring NetFlow Multiple Export Destinations 62Example Configuring NetFlow Version 5 Data Export 62Example Configuring NetFlow Version 1 Data Export 63Additional References 63Feature Information for Configuring NetFlow and NetFlow Data Export 64Glossary 66Configuring NetFlow Aggregation Caches 69Finding Feature Information 69Prerequisites for Configuring NetFlow Aggregation Caches 69Restrictions for Configuring NetFlow Aggregation Caches 70NetFlow Data Export 70Information About Configuring NetFlow Aggregation Caches 71NetFlow Aggregation Caches 71NetFlow Cache Aggregation Benefits 71NetFlow Cache Aggregation Schemes 71NetFlow Aggregation Scheme Fields 73NetFlow Configuration Guide, Cisco IOS Release 12.2SXv

ContentsNetFlow AS Aggregation Scheme 75NetFlow AS-ToS Aggregation Scheme 76NetFlow Destination Prefix Aggregation Scheme 78NetFlow Destination Prefix-ToS Aggregation Scheme 79NetFlow Prefix Aggregation Scheme 81NetFlow Prefix-Port Aggregation Scheme 82NetFlow Prefix-ToS Aggregation Scheme 84NetFlow Protocol Port Aggregation Scheme 86NetFlow Protocol-Port-ToS Aggregation Scheme 87NetFlow Source Prefix Aggregation Scheme 89NetFlow Source Prefix-ToS Aggregation Scheme 90NetFlow Data Export Format Versions 9 and 8 for NetFlow Aggregation Caches Overview 92How to Configure NetFlow Aggregation Caches 92Configuring NetFlow Aggregation Caches 92Verifying the Aggregation Cache Configuration 96Configuration Examples for Configuring NetFlow Aggregation Caches 98Configuring an AS Aggregation Cache Example 98Configuring a Destination Prefix Aggregation Cache Example 99Configuring a Prefix Aggregation Cache Example 99Configuring a Protocol Port Aggregation Cache Example 99Configuring a Source Prefix Aggregation Cache Example 100Configuring an AS-ToS Aggregation Cache Example 100Configuring a Prefix-ToS Aggregation Cache Example 100Configuring the Minimum Mask of a Prefix Aggregation Scheme Example 101Configuring the Minimum Mask of a Destination Prefix Aggregation Scheme Example 101Configuring the Minimum Mask of a Source Prefix Aggregation Scheme Example 101Configuring NetFlow Version 9 Data Export for Aggregation Caches Example 102Configuring NetFlow Version 8 Data Export for Aggregation Caches Example 102Additional References 102Feature Information for Configuring NetFlow Aggregation Caches 104Glossary 105Configuring NetFlow BGP Next Hop Support for Accounting and Analysis 107Finding Feature Information 107Prerequisites for NetFlow BGP Next Hop Support 107Restrictions for NetFlow BGP Next Hop Support 108NetFlow Configuration Guide, Cisco IOS Release 12.2SXvi

ContentsInformation About NetFlow BGP Next Hop Support 108NetFlow BGP Next Hop Support Benefits 108NetFlow BGP Next Hop Support and NetFlow Aggregation 109How to Configure NetFlow BGP Next Hop Support 109Configuring NetFlow BGP Next Hop Accounting 109Troubleshooting Tips 111Verifying the Configuration 111Configuration Examples for NetFlow BGP Next Hop Support 113Example Configuring NetFlow BGP Next Hop Accounting 113Additional References 113Feature Information for NetFlow BGP Next Hop Support 114Glossary 115Configuring NetFlow BGP Next Hop Support for Accounting and Analysis 117Finding Feature Information 117Prerequisites for NetFlow BGP Next Hop Support 117Restrictions for NetFlow BGP Next Hop Support 118Information About NetFlow BGP Next Hop Support 118NetFlow BGP Next Hop Support Benefits 118NetFlow BGP Next Hop Support and NetFlow Aggregation 119How to Configure NetFlow BGP Next Hop Support 119Configuring NetFlow BGP Next Hop Accounting 119Troubleshooting Tips 121Verifying the Configuration 121Configuration Examples for NetFlow BGP Next Hop Support 123Example Configuring NetFlow BGP Next Hop Accounting 123Additional References 123Feature Information for NetFlow BGP Next Hop Support 124Glossary 125Configuring NetFlow Multicast Accounting 127Finding Feature Information 127Prerequisites for Configuring NetFlow Multicast Accounting 127Restrictions for Configuring NetFlow Multicast Accounting 128Information About Configuring NetFlow Multicast Accounting 128NetFlow Multicast Benefits 128Multicast Ingress and Multicast Egress Accounting 128NetFlow Configuration Guide, Cisco IOS Release 12.2SXvii

ContentsNetFlow Multicast Flow Records 129How to Configure NetFlow Multicast Accounting 129Configuring NetFlow Multicast Accounting in Releases 12.4(12) 129Troubleshooting Tips 131Configuring NetFlow Multicast Accounting in Cisco IOS Releases Prior to 12.4(12) 131Configuring NetFlow Multicast Egress Accounting 131Troubleshooting Tips 132Configuring NetFlow Multicast Ingress Accounting 132Troubleshooting Tips 134Verifying the NetFlow Multicast Accounting Configuration 134Configuration Examples for NetFlow Multicast Accounting 135Configuring NetFlow Multicast Accounting in Original Releases 135Configuring NetFlow MC Accounting in Releases Prior to 12.2(33)SRB 136Configuring NetFlow Multicast Egress Accounting Example 136Configuring NetFlow Multicast Ingress Accounting Example 136Additional References 136Feature Information for Configuring NetFlow Multicast Accounting 138Glossary 139Configuring NetFlow Top Talkers using Cisco IOS CLI Commands or SNMP Commands 141Finding Feature Information 141Prerequisites for Configuring NetFlow Top Talkers 141Restrictions for Configuring NetFlow Top Talkers 142Information About Configuring NetFlow Top Talkers 142Overview of the NetFlow MIB and Top Talkers Feature 142Benefits of the NetFlow MIB and Top Talkers Feature 143Cisco IOS Release 12.2(33)SXH on Cisco 6500 Series Switches 143How to Configure NetFlow Top Talkers using Cisco IOS CLI Commands or SNMPCommands 143Configuring SNMP Support on the Networking Device 144Configuring Parameters for the NetFlow Main Cache 145Configuring Parameters for the NetFlow Main Cache 147Identifying the Interface Number to Use for Enabling NetFlow with SNMP 147Configuring NetFlow on a Cisco 6500 Series Switch 148Configuring NetFlow on a Cisco 6500 Series Switch 150Configuring NetFlow on Cisco Routers 151NetFlow Configuration Guide, Cisco IOS Release 12.2SXviii

ContentsConfiguring NetFlow on Cisco Routers 153Configuring NetFlow Top Talkers 153Configuring NetFlow Top Talkers 155Configuring NetFlow Top Talkers Match Criteria 156NetFlow Top Talkers Match Criteria Specified by CLI Commands 157NetFlow Top Talkers Match Criteria Specified by SNMP Commands 157Configuring Source IP Address Top Talkers Match Criteria 159Configuring Source IP Address Top Talkers Match Criteria 160Verifying the NetFlow Top Talkers Configuration 161Verifying the NetFlow Top Talkers Configuration 162Configuration Examples for NetFlow Top Talkers 163Configuring NetFlow Top Talkers Using SNMP Commands Example 163Configuring NetFlow Top Talkers Match Criteria Using SNMP Commands Example 164Additional References 164Feature Information for Configuring NetFlow Top Talkers using the Cisco IOS CLI or SNMPCommands 166Configuring NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces 169Finding Feature Information 169Prerequisites for Configuring NetFlow Accounting for Unicast and Multicast on GRE IP TunnelInterfaces 170Restrictions for Configuring NetFlow Accounting for Unicast and Multicast on GRE IP TunnelInterfaces 170Information About NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces 170GRE Tunneling 170GRE Tunnel Keepalive 171Tunnel Interfaces 171NetFlow Accounting on GRE IP Tunnel Interfaces 171How to Configure NetFlow Accounting for Unicast and Multicast on GRE Tunnel Interfaces 175Sample Network 176Configuring a GRE IP Tunnel 176Verifying the Status of the GRE IP Tunnel 180Configuring NetFlow Accounting on a GRE IP Tunnel Interface 181Configuring NetFlow Accounting on the Physical Interfaces 182Verifying NetFlow Accounting 184Configuring NetFlow Data Export Using the Version 9 Export Format 186Verifying That NetFlow Data Export Is Operational 189NetFlow Configuration Guide, Cisco IOS Release 12.2SXix

ContentsConfiguration Examples for NetFlow Accounting for Unicast and Multicast on GRE TunnelInterfaces 190Configuring a GRE IP Tunnel Example 190Configuring NetFlow Accounting on a GRE IP Tunnel Example 191Additional References 192Feature Information for Configuring NetFlow Accounting for Unicast and Multicast on GREIP Tunnel Interfaces 193NetFlow Configuration Guide, Cisco IOS Release 12.2SXx

Cisco IOS NetFlow OverviewNetFlow is a Cisco IOS application that provides statistics on packets flowing through the router. It isemerging as a primary network accounting and security technology. This module provides an overview ofthe NetFlow application and advanced NetFlow features and services. Finding Feature Information, page 1Information About Cisco IOS NetFlow, page 1How to Configure Cisco IOS NetFlow, page 7Configuration Examples for Cisco IOS NetFlow, page 8Where to Go Next, page 8Additional References, page 8Glossary, page 10Finding Feature InformationYour software release may not support all the features documented in this module. For the latest featureinformation and caveats, see the release notes for your platform and software release. To find informationabout the features documented in this module, and to see a list of the releases in which each feature issupported, see the Feature Information Table at the end of this document.Use Cisco Feature Navigator to find information about platform support and Cisco software image support.To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.Information About Cisco IOS NetFlow 6The NetFlow Application, page 2NetFlow Benefits Monitoring Analysis and Planning Security and Accounting and Billing, page 2NetFlow Cisco IOS Packaging Information, page 3NetFlow Flows, page 3NetFlow Main Cache Operation, page 4NetFlow Data Capture, page 4NetFlow Export Formats, page 4NetFlow Operation Processing Order of NetFlow Features, page 5NetFlow Preprocessing Features Filtering and Sampling, page 5NetFlow Advanced Features and Services BGP Next Hop Multicast MPLS NetFlow Layer 2, pageNetFlow Configuration Guide, Cisco IOS Release 12.2SX1

The NetFlow ApplicationInformation About Cisco IOS NetFlow NetFlow Postprocessing Features Aggregation Schemes and Export to Multiple Destinations, page7 NetFlow MIBs, page 7The NetFlow ApplicationNetFlow is a Cisco IOS application that provides statistics on packets flowing through the routing devicesin the network. It is emerging as a primary network accounting and security technology.NetFlow identifies packet flows for both ingress and egress IP packets. It does not involve any connectionsetup protocol, either between routers or to any other networking device or end station. NetFlow does notrequire any change externally--either to the packets themselves or to any networking device. NetFlow iscompletely transparent to the existing network, including end stations and application software and networkdevices like LAN switches. Also, NetFlow capture and export are performed independently on eachinternetworking device; NetFlow need not be operational on each router in the network.NetFlow is supported on IP and IP encapsulated traffic over most interface types and encapsulations.However, NetFlow does not support ATM LAN emulation (LANE) and does not support an Inter-SwitchLink (ISL)/virtual LAN (VLAN), ATM, or Frame Relay interfaces when more than one input accesscontrol list (ACL) is used on the interface. Cisco 12000 IP Service Engine ATM line cards do not have thisrestriction when more than one input ACL is used on the interface.You can display and clear NetFlow statistics. NetFlow statistics consist of IP packet size distribution data,IP flow switching cache information, and flow information. See the NetFlow Flows, page 3.NetFlow Benefits Monitoring Analysis and Planning Security andAccounting and BillingNetFlow captures a rich set of traffic statistics. These traffic statistics include user, protocol, port, and typeof service (ToS) information that can be used for a wide variety of purposes such as network applicationand user monitoring, network analysis and planning, security analysis, accounting and billing, trafficengineering, and NetFlow data warehousing and data mining.Network Application and User MonitoringNetFlow data enables you to view detailed, time- and application-based usage of a network. Thisinformation allows you to plan and allocate network and application resources, and provides for extensivenear real-time network monitoring capabilities. It can be used to display traffic patterns and applicationbased views. NetFlow provides proactive problem detection and efficient troubleshooting, and it facilitatesrapid problem resolution. You can use NetFlow information to efficiently allocate network resources and todetect and resolve potential security and policy violations.Network PlanningNetFlow can capture data over a long period of time, which enables you to track and anticipate networkgrowth and plan upgrades. NetFlow service data can be used to optimize network planning, which includespeering, backbone upgrade planning, and routing policy planning. It also enables you to minimize the totalcost of network operations while maximizing network performance, capacity, and reliability. NetFlowdetects unwanted WAN traffic, validates bandwidth and quality of service (QoS) usage, and enables theanalysis of new network applications. NetFlow offers valuable information that you can use to reduce thecost of operating the network.NetFlow Configuration Guide, Cisco IOS Release 12.2SX2

NetFlow Cisco IOS Packaging InformationInformation About Cisco IOS NetFlowDenial of Service and Security AnalysisYou can use NetFlow data to identify and classify denial of service (DoS) attacks, viruses, and worms inreal-time. Changes in network behavior indicate anomalies that are clearly reflected in NetFlow data. Thedata is also a valuable forensic tool that you can use to understand and replay the history of securityincidents. Accounting and BillingNetFlow data provides fine-grained metering for highly flexible and detailed resource utilizationaccounting. For example, flow data includes details such as IP addresses, packet and byte counts,timestamps, type-of-service, and application ports. Service providers might utilize the information forbilling based on time-of-day, bandwidth usage, application usage, or quality of service. Enterprisecustomers might utilize the information for departmental chargeback or cost allocation for resourceutilization.Traffic EngineeringNetFlow provides autonomous system (AS) traffic engineering details. You can use NetFlow-capturedtraffic data to understand source-to-destination traffic trends. This data can be used for load-balancingtraffic across alternate paths or for forwarding traffic to a preferred route. NetFlow can measure the amountof traffic crossing peering or transit points to help you determine if a peering arrangement with otherservice providers is fair and equitable. NetFlow Data Storage and Data MiningNetFlow data (or derived information) can be stored for later retrieval and analysis in support of marketingand customer service programs. For example, the data can be used to find out which applications andservices are being used by internal and external users and to target those users for improved service andadvertising. In addition, NetFlow data gives market researchers access to the who, what, where, and howlong information relevant to enterprises and service providers.NetFlow Cisco IOS Packaging InformationCisco 7200/7500/7400/MGX/AS5800Although NetFlow functionality is included in all software images for these platforms, you must purchase aseparate NetFlow feature license. NetFlow licenses are sold on a per-node basis. Other RoutersUse Cisco Feature Navigator to find information about platform support and Cisco IOS software imagesupport. Access Cisco Feature Navigator at http://www.cisco.com/go/fn . You must have an account onCisco.com. If you do not have an account or have forgotten your username or password, click Cancel at thelogin dialog box and follow the instructions that appear.NetFlow FlowsA NetFlow network flow is defined as a unidirectional stream of packets between a given source anddestination. The source and destination are each defined by a network-layer IP address and transport-layersource and destination port numbers. Specifically, a flow is defined by the combination of the followingseven key fields:NetFlow Configuration Guide, Cisco IOS Release 12.2SX3

NetFlow Main Cache OperationInformation About Cisco IOS NetFlow Source IP addressDestination IP addressSource port numberDestination port numberLayer 3 protocol typeType of service (ToS)Input logical interfaceThese seven key fields define a unique flow. If a packet has one key field different from another packet, itis considered to belong to another flow. A flow might also contain other accounting fields (such as the ASnumber in the NetFlow export Version 5 flow format), depending on the export record version that youconfigure. Flows are stored in the NetFlow cache.NetFlow Main Cache OperationThe key components of NetFlow are the NetFlow cache that stores IP flow information, and the NetFlowexport or transport mechanism that sends NetFlow data to a network management collector, such as theNetFlow Collection Engine. NetFlow operates by creating a NetFlow cache entry (a flow record) for eachactive flow. NetFlow maintains a flow record within the cache for each active flow. Each flow record in theNetFlow cache contains fields that can later be exported to a collection device, such as the NetFlowCollection Engine.NetFlow Data CaptureNetFlow captures data from ingress (incoming) and egress (outgoing) packets. NetFlow gathers data for thefollowing ingress IP packets: IP-to-IP packetsIP-to-Multiprotocol Label Switching (MPLS) packetsFrame Relay-terminated packetsATM-terminated packetsNetFlow captures data for all egress (outgoing) packets through the use of the following features: Egress NetFlow Accounting--NetFlow gathers data for all egress packets for IP traffic only.NetFlow MPLS Egress--NetFlow gathers data for all egress MPLS-to-IP packets.NetFlow Export FormatsNetFlow exports data in UDP datagrams in one of five formats: Version 9, Version 8, Version 7, Version 5,or Version 1. Version 9 export format, the latest version, is the most flexible and extensive format. Version1 was the initial NetFlow export format; Version 7 is supported only on certain platforms, and Version 8only supports export from aggregation cache. (Versions 2 through 4 and Version 6 were either not releasedor are not supported.) Version 9--A flexible and extensible format, which provides the versatility needed for support of newfields and record types. This format accommodates new NetFlow-supported technologies such asmulticast, Multiprotocol Label Switching (MPLS), and Border Gateway Protocol (BGP) next hop. Thedistinguishing feature of the NetFlow Version 9 format is that it is template based. Templates providea means of extending the record format, a feature that should allow future enhancements to NetFlowservices without requiring concurrent changes to the basic flow-record format. Internet ProtocolInformation Export (IPFIX) was based on the Version 9 export format.NetFlow Configuration Guide, Cisco IOS Release 12.2SX4

NetFlow Operation Processing Order of NetFlow FeaturesInformation About Cisco IOS NetFlow Version 8--A format added to support data export from aggregation caches. Version 8 allows exportdatagrams to contain a subset of the usual Version 5 export data, if that data is valid for a particularaggregation cache scheme.Version 7--A version supported on Catalyst 6000 series switches with a Multilayer Switch FeatureCard (MSFC) on CatOS Release 5.5(7) and later.On Catalyst 6000 series switches with an MSFC, you can export using either the Version 7 or Version 8format.Information about and instructions for configuring NetFlow on Catalyst 6000 series switches is available inthe Catalyst 6500 Series Switches documentation. Version 5--A version that adds BGP autonomous system (AS) information and flow sequencenumbers.Version 1, the initially released export format, is rarely used today. Do not use the Version 1 exportformat unless the legacy collection system you are using requires it. Use either the Version 9 exportformat or the Version 5 export format for data export from the main cache.For more information on a specific NetFlow data export format, see the "Configuring NetFlow andNetFlow Data Export" module.NetFlow Operation Processing Order of NetFlow FeaturesThe NetFlow application supports features that you can set up to further analyze network traffic data.NetFlow divides these features and services into the following three categories for processing: Preprocessing features that allow you to collect subsets of your network traffic data for analysis.Advanced features and services based on the flexible NetFlow Version 9 export format that allow youto collect data on types of traffic in addition to IP traffic.Postprocessing features that allow you to define fields that control how traffic data is exported.You need to decide if you want to further analyze your network traffic. If you do want to do furtheranalysis, you need to make choices in two areas: Do you want to customize or fine-tune the way that you collect NetFlow data? For example, you mightwant to configure packet sampling, or packet filtering, or an aggregation scheme.Do you want to collect and analyze data about the use of other Cisco IOS applications? For example,you might want to configure NetFlow support for BGP next hop, multicast, MPLS, or IPv6.Before you configure or enable an additional NetFlow feature or service, you need to understand theprerequisites, restrictions, and key concepts that apply to each feature or service. Refer to the followingsections for information about and links to the NetFlow features and services:NetFlow Preprocessing Features Filtering and SamplingThe table below briefly describes preprocessing features and indicates where you can find concept and taskinformation about each. You set up these features to select the subset of traffic of interest to you beforeNetFlow processing begins.NetFlow Configuration Guide, Cisco IOS Release 12.2SX5

NetFlow Advanced Features and Services BGP Next Hop Multicast MPLS NetFlow Layer 2Information About Cisco IOS NetFlowTable 1NetFlow Preprocessing FeaturesPreprocessing FeatureBrief DescriptionSource for Concept and TaskInformationPacket samplingSets up statistical sampling ofnetwork traffic for trafficengineering or capacity planningSee the "Using NetFlow Filteringor Sampling to Select theNetwork Traffic to Track"module.FilteringSets up a specific subset ofnetwork traffic for class-basedtraffic analysis and monitoringon-network or off-network trafficSee the "Using NetFlow Filteringor Sampling to Select theNetwork Traffic to Track"module.NetFlow Advanced Features and Services BGP Next Hop Multicast MPLSNetFlow Layer 2The table below briefly describes advanced features and services supported by NetFlow and indicateswhere you can find concept and task information about each. Configure these features and services tocollect and analyze NetFlow t

Configuring NetFlow on a Cisco 6500 Series Switch 148 Configuring NetFlow on a Cisco 6500 Series Switch 150 Configuring NetFlow on Cisco Routers 151 Contents NetFlow Configuration Guide, Cisco IOS Release 12.2SX viii . Configuring NetFlow on Cisco Routers 153 Configuring NetFlow Top Talkers 153

Related Documents:

Cisco 3560 & 3750 NetFlow Configuration Guide Cisco Nexus 7000 NetFlow Configuration Cisco Nexus 1000v NetFlow Configuration Cisco ASR 9000 NetFlow Configuration Appendix. 3 Cisco NetFlow Configuration Cisco IOS NetFlow Configuration Guide Netflow Configuration In configuration mode issue the following to enable NetFlow Export:

Cisco 3560 & 3750 NetFlow Configuration Guide Cisco Nexus 7000 NetFlow Configuration Cisco Nexus 1000v NetFlow Configuration Cisco ASR 9000 NetFlow Configuration Appendix. 8 Cisco NetFlow Configuration Cisco 3560X & 3750X NetFlow Configuration Your software release may not support all the features documented in this module.File Size: 2MB

NetFlow Cisco Catalyst 6500 NetFlow Collector . Cisco NetFlow Support 20 2011 Lancope , Inc. . Cisco 2800 Cisco 7600 Cisco 1700 Cisco Catalyst 6500 Cisco ASR Cisco 3560/3750-X Cisco ASA Cisco ISR G2 Hardware Supported Cisco Catalyst 4500 . Wide Support for NetFlow Nortel Networks Junip

Example: Router enable Enteryourpasswordifprompted. configureterminal (Required)Entersglobalconfigurationmode. Example: Router# configure terminal Step 2 NetFlow Configuration Guide, Cisco IOS Release 15M&T 5 Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data How to Configure SNMP and use the NetFlow MIB to Monitor NetFlow Data

Flexible NetFlow Configuration Guide, Cisco IOS Release 15.2(3)E and Later (Catalyst 3750-X and 3560-X Switches) 3 Configuring Flexible NetFlow Information About Flexible Netflow . Flexible NetFlow Configuration Guide, Cisco IOS Release 15.2(3)E and Later (Catalyst 3750-X and 3560-X Switches) 17 Configur

NetFlow-lite Aggregators and collectors can sit anywhere in the network, as long as L3 reachable NetFlow-lite Aggregators are transparent to NetFlow collector (NetFlow collectors receive aggregated flow data as if it's coming directly from the switch) NetFlow collector analyzes & correlates both NetFow and aggregated NetFlow-lite data

NetFlow Configuration Guide, Cisco IOS Release 15M&T 4 Configuring NetFlow Top Talkers using Cisco IOS CLI Commands or SNMP Commands How to Configure NetFlow Top Talkers using

2.15.20 Profit sharing transactions 28 2.15.21 Re-importation of goods after repair or processing abroad 29 2.15.22 Split shipments or split consignments 29 2.15.23 Sole distributors, concessionaires and agents 30 2.15.24 Tie-in sales 30 . Effective 24 January 2014 Valuation of Imports – External Directive SC-CR-A-03 Revision: 2 Page 3 of 52 2.15.25 Time element 30 2.15.26 Transfer pricing .