Network Assurance · Topic 3 of 7

Flexible NetFlow

Configure and verify Flexible NetFlow on IOS XE with flow records, exporters and monitors, key and non key fields, interface application and show commands.

  • 5 min
In a nutshell
  • A flow is a set of packets that share key field values.
  • Flexible NetFlow has three objects: record, exporter and monitor.
  • match fields are key fields, and collect fields are non key fields.

What it is

Flexible NetFlow (FNF) records information about the traffic that passes through a device, and exports it to a collector for analysis.

A flow is a set of packets that share key values, such as the source address, destination address, protocol and ports. The device counts packets and bytes for each flow. A collector then turns this data into reports on who is using the network and for what.

Interfacetraffic passesmonitor counts flowsFlow cacheone entry per flowexporter sendsCollectoranalysis tool

How it works

You build three objects and apply one of them to an interface.

NetFlow versions

VersionNotes
v5Fixed set of fields, IPv4 only
v9Template based, so fields can be chosen, and supports IPv6
IPFIXThe IETF standard that is based on version 9, and sometimes called version 10

Flexible NetFlow uses version 9 or IPFIX, because only template based formats let you choose the fields.

The three building blocks

ObjectJob
Flow recordSays which fields identify a flow, and which extra data to collect
Flow exporterSays where to send the data, and how
Flow monitorTies a record to an exporter, and holds the flow cache

The monitor is the object that you apply to an interface. The examples use IOS XE syntax, and keywords can differ on other platforms and releases.

Flow record

A record has two kinds of field. The match fields are the key fields. Packets with the same key values belong to the same flow.

The collect fields are non key fields, and they are extra data that is gathered for each flow.

R1(config)# flow record APP-RECORD
R1(config-flow-record)# match ipv4 source address
R1(config-flow-record)# match ipv4 destination address
R1(config-flow-record)# match ipv4 protocol
R1(config-flow-record)# match transport source-port
R1(config-flow-record)# match transport destination-port
R1(config-flow-record)# collect counter bytes
R1(config-flow-record)# collect counter packets

If you change the key fields, you change what counts as one flow. Fewer key fields give fewer, larger flows. More key fields give more detail and use more memory.

Cisco also provides predefined records for common cases, so you do not always have to build one.

Flow exporter

R1(config)# flow exporter EXPORT-TO-COLLECTOR
R1(config-flow-exporter)# destination 10.1.1.200
R1(config-flow-exporter)# source Loopback0
R1(config-flow-exporter)# transport udp 2055
R1(config-flow-exporter)# export-protocol netflow-v9

The collector address is in destination, and the UDP port is in transport. The port must match what the collector listens on, and 2055 is a common choice. The source interface sets the source address of the export packets.

Flow monitor

R1(config)# flow monitor APP-MONITOR
R1(config-flow-monitor)# record APP-RECORD
R1(config-flow-monitor)# exporter EXPORT-TO-COLLECTOR

Applying the monitor

Apply the monitor to an interface in a direction. Flows are counted for traffic that enters or leaves in that direction.

R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip flow monitor APP-MONITOR input

Use output to collect on traffic that leaves. To capture both directions of a conversation, apply the monitor to both. For IPv6 the command is ipv6 flow monitor.

Flow recordmatch and collect fieldsused byFlow monitorholds the cacheused byInterfaceip flow monitor inputFlow exportercollector addressused byFlow monitorsends to collector

Sampling

On a busy link, counting every packet can use a lot of resources. A sampler tells the monitor to examine only a share of the packets, for example one in a hundred. The results are then an estimate, but they are cheaper to produce.

Verifying

R1# show flow monitor APP-MONITOR cache
R1# show flow exporter
R1# show flow record
R1# show flow interface

show flow monitor NAME cache is the best test. It shows the live flows in the cache, with the key fields and the counters.

show flow exporter shows the destination and the export statistics, such as the number of packets sent. If the cache fills but the collector is empty, check the exporter destination, the port and the route to the collector.

Typical uses

  • Find the top talkers on a link.
  • Spot unusual traffic, such as a scan or a large unexpected transfer.
  • See which applications use the most bandwidth.
  • Support capacity planning and billing.

NetFlow shows who talks to whom and how much. It does not capture the packet contents, so it cannot replace a packet capture.

What to remember for the exam

Eight facts cover most questions on this topic.

  • A flow is a set of packets that share key field values.
  • Flexible NetFlow has three objects: record, exporter and monitor.
  • match fields are key fields, and collect fields are non key fields.
  • The exporter holds the collector address, the UDP port and the export protocol.
  • The monitor links the record and exporter, and it is applied to an interface.
  • ip flow monitor NAME input applies the monitor to incoming traffic.
  • Version 9 and IPFIX are template based, so fields can be chosen.
  • show flow monitor NAME cache shows the live flows.
Exam tip

To remember the order, build the record, then the exporter, then the monitor, then apply the monitor to the interface.

Common mistakes

These four mistakes appear often.

Applying the record or exporter to the interface. Only the monitor is applied to an interface.

Choosing the wrong direction. A monitor on input sees only traffic that enters the interface.

Mismatching the collector port. The device exports, but the collector never receives anything.

Using too many key fields on a busy link. The cache grows large and uses a lot of memory.

Watch out

NetFlow data shows traffic patterns, not packet contents, so do not rely on it to prove what an application sent.

Check yourself

Work through these three questions.

  • Which object is applied to an interface in Flexible NetFlow?

    The flow monitor is applied to the interface, using the ip flow monitor command.

  • What is the difference between match and collect in a flow record?

    Match fields are key fields that define a flow, and collect fields are extra data gathered for each flow.

  • Which command shows the live flows that a monitor has recorded?

    show flow monitor NAME cache shows them.

Topic 3 of 7 in Network Assurance

Test yourself on Network Assurance

The full Cisco CCNP 350-401 ENCOR question bank has 854 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.