Automation and Assurance · Topic 6 of 7

NetFlow and IPFIX

Configure and verify Flexible NetFlow and IPFIX with flow records, exporters, monitors, sampling and cache timers on XE and XR, and compare versions.

6 min

In a nutshell

A flow is a set of packets with the same key fields.
NetFlow v9 and IPFIX are template based, and IPFIX is the IETF standard.
IPFIX uses UDP port 4739 by default.

What it is

NetFlow and IPFIX summarise network traffic into flow records, so you can see who is talking to whom and how much.

A router watches packets, groups them into flows, and counts bytes and packets for each flow. It then exports the records to a collector. Providers use this for capacity planning, billing, security and finding the source of an attack.

How it works

Three pieces of configuration define what is measured, where it is sent, and where it applies.

What a flow is

A flow is a series of packets that share the same key fields. The classic key fields are the source and destination address, the source and destination port, the protocol, the type of service and the input interface.

Packets that match all of these belong to the same flow. The router keeps a cache entry for each flow, with counters such as bytes and packets. When the flow ends or a timer expires, the entry is exported.

NetFlow and IPFIX versions

Version	Notes
NetFlow v5	Fixed record format, IPv4 only
NetFlow v9	Template based, so fields can be chosen, and supports IPv6 and MPLS
IPFIX	The IETF standard, based on v9, and also called version 10

Version 9 and IPFIX send templates that describe the layout of the data records. The collector uses the template to read the records.

IPFIX is the open standard, and it uses UDP port 4739 by default. Many collectors are also set to listen on other ports such as 2055 for NetFlow, and the exporter must match the collector.

Flexible NetFlow on IOS XE

Flexible NetFlow has three building blocks.

Block	Purpose
Flow record	The fields to match as keys, and the fields to collect
Flow exporter	Where and how to send the records
Flow monitor	Joins a record and an exporter, and holds the cache

The monitor is then applied to an interface in a direction.

Router(config)# flow record REC1
Router(config-flow-record)# match ipv4 source address
Router(config-flow-record)# match ipv4 destination address
Router(config-flow-record)# match transport source-port
Router(config-flow-record)# match transport destination-port
Router(config-flow-record)# match ipv4 protocol
Router(config-flow-record)# match interface input
Router(config-flow-record)# collect counter bytes long
Router(config-flow-record)# collect counter packets long
Router(config)# flow exporter EXP1
Router(config-flow-exporter)# destination 192.0.2.50
Router(config-flow-exporter)# source Loopback0
Router(config-flow-exporter)# transport udp 4739
Router(config-flow-exporter)# export-protocol ipfix
Router(config)# flow monitor MON1
Router(config-flow-monitor)# record REC1
Router(config-flow-monitor)# exporter EXP1
Router(config)# interface GigabitEthernet0/0/0
Router(config-if)# ip flow monitor MON1 input

Fields under match are the keys, and fields under collect are extra data that is added to the record.

Router# show flow monitor MON1 cache
Router# show flow exporter EXP1 statistics

NetFlow on IOS XR

Large provider routers carry too much traffic to track every packet, so IOS XR configurations normally use sampling. A sampler map picks one packet in a number, such as one in 1000, and only those packets are counted.

RP/0/RP0/CPU0:R1(config)# flow exporter-map EXP1
RP/0/RP0/CPU0:R1(config-fem)# version v9
RP/0/RP0/CPU0:R1(config-fem-ver)# template data timeout 600
RP/0/RP0/CPU0:R1(config-fem-ver)# exit
RP/0/RP0/CPU0:R1(config-fem)# transport udp 2055
RP/0/RP0/CPU0:R1(config-fem)# source Loopback0
RP/0/RP0/CPU0:R1(config-fem)# destination 192.0.2.50
RP/0/RP0/CPU0:R1(config)# flow monitor-map MON1
RP/0/RP0/CPU0:R1(config-fmm)# record ipv4
RP/0/RP0/CPU0:R1(config-fmm)# exporter EXP1
RP/0/RP0/CPU0:R1(config-fmm)# cache timeout active 60
RP/0/RP0/CPU0:R1(config)# sampler-map SAMP1
RP/0/RP0/CPU0:R1(config-sm)# random 1 out-of 1000
RP/0/RP0/CPU0:R1(config)# interface GigabitEthernet0/0/0/0
RP/0/RP0/CPU0:R1(config-if)# flow ipv4 monitor MON1 sampler SAMP1 ingress

The IOS XR names differ from IOS XE. The exporter is an exporter map, the monitor is a monitor map, and the interface command names the address family.

RP/0/RP0/CPU0:R1# show flow monitor MON1 cache location 0/0/CPU0
RP/0/RP0/CPU0:R1# show flow exporter-map EXP1

Cache timers

The flow cache has two timers. The active timeout exports long flows regularly, even if they have not ended.

The inactive timeout exports a flow that has stopped sending. Shorter timers give fresher data, but they create more export traffic.

What to remember for the exam

Seven facts cover most questions on this topic.

A flow is a set of packets with the same key fields.
NetFlow v9 and IPFIX are template based, and IPFIX is the IETF standard.
IPFIX uses UDP port 4739 by default.
Flexible NetFlow has a record, an exporter and a monitor, applied to an interface.
On IOS XE the interface command is ip flow monitor NAME input.
IOS XR uses exporter maps, monitor maps and sampler maps, with flow ipv4 monitor.
The active timeout exports long flows, and the inactive timeout exports idle flows.

Exam tip

Match fields are keys that define the flow, and collect fields are extra data. A question about what makes two packets one flow is about the match fields.

Common mistakes

These four mistakes appear often.

Forgetting to apply the monitor to an interface. Nothing is measured until it is applied.

Setting the exporter to a different port from the collector. The records arrive at a port nobody listens on.

Using no sampling on a busy provider link. The router can run out of cache or CPU.

Mixing up a record and a monitor. The record lists the fields, and the monitor joins it with an exporter.

Watch out

NetFlow shows traffic patterns, and so it exposes sensitive information. Send it only to trusted collectors.

Check yourself

Work through these three questions.

What makes up a flow?
Packets that share the same key fields, such as addresses, ports, protocol and input interface.
What are the three Flexible NetFlow building blocks?
A flow record, a flow exporter and a flow monitor.
Why use sampling on IOS XR?
Large provider links carry too much traffic to track every packet, so only one packet in a number is counted.

Topic 6 of 7 in Automation and Assurance

Test yourself on Automation and Assurance

The full Cisco CCNP 350-501 SPCOR question bank has 738 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.