NetFlow - jibingl/CCNA-CCNP GitHub Wiki
| Version | Description/Key Features | IPv4 | IPv6 | MPLS | Template-Based | Status |
|---|---|---|---|---|---|---|
| v1 | Original implementation | Yes | No | No | No | Obsolete |
| v5 | Fixed-format, industry standard | Yes | No | No | No | Legacy (Used) |
| v7 | Catalyst switch focus, similar to v5 | Yes | No | No | No | Obsolete |
| v8 | Router-based aggregation | Yes | No | No | No | Obsolete |
| v9 | Flexible NetFlow (FNF), template-based | Yes | Yes | Yes | Yes | Current |
| v10 | IPFIX (IETF Standard) | Yes | Yes | Yes | Yes | Current |
Components of A NetFlow Monitoring Setup
NetFlow_Enabled
HOST_A ------------------ ( ROUTER ) --------------------------- HOST_B
| Flow Exporter
|
`--> Flow Collector <--- Flow Analyzer
- Flow Exporter: Aggregates packets into flow records and exports towards one or more flow collectors.
- Flow Collector: Responsible for reception, storage and pre-processing.
- Flow Analyzer: Analyzes received flow data in the context of intrusion detection or traffic profiling, for example.
Cisco NetFlow v9.0
NetFlow Version 9 Export Packet
+---------------+------------------+--------------+--------+------------------+--------------+
| Packet Header | Template FlowSet | Data FlowSet | ...... | Template FlowSet | Data FlowSet |
+---------------+------------------+--------------+--------+------------------+--------------+
Packet Header Format
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Version (0x0009) | Count (total flowsets) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| System Uptime (since booted) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| UNIX Seconds (since 1-1-1970) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Package Sequence |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Packet FlowSet Format
Template & Data FlowSet Example FlowSet
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ start_of_template +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = 0 (0~255) | | FlowSet ID = 0 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Length (this flowset) | | Length = 20 bytes |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID (>255) | | Template ID = 256 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Count | | Field Count = 3 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field 1 Type | | IPv4_SRCADDR (0x0008) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field 1 Length | | Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field 2 Type | | IPv4_DSTADDR (0x000C) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ...... | | Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field n Type | | IPv4_NEX_HOP (0x000E) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field n Length | | Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ start_of_data +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = template_id | | FlowSet ID = 256 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Length (this flowset) | | Length = 28 bytes |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1 - Field 1 value | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.168.1.10 | Field 1
| ...... | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1 - Field n value | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 172.16.0.100 | Field 2
| Record 2 - Field 1 value | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ...... | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.168.1.1 | Field 3
| Record 2 - Field n value | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
7 Pre-defined Key Fields of NetFlow
(If one field is different, a new flow is created in the flow cache.)
- Source IP address
- Destination IP address
- Source port number
- Destination port number
- Layer 3 protocol type (ex. TCP, UDP)
- Type of service (ToS)
- Input/Ingress interface
Flexible NetFlow
- Define custom fields other than the 7 key fields.
- Uses multiple flow monitors on the same traffic.
- Multiple flow policies separate data outputs.
NetFlow Secure Event Logging (NSEL)
- Stateful Tracking: NSEL tracks the entire lifecycle of a flow, from creation to teardown.
- Event Driven: It logs critical events - flow-create, flow-teardown, flow-denied, and flow-update.
- Treats bidirectional traffic as a single flow.
- Delays the export of flow-create events to reduce unnecessary log entries by preventing the export of data for very short-lived flows.
Configuration Example
Cisco c8000v
! 1. Define a FLOW RECORD - define fields and collection params
flow record lab-ipv4
match ipv4 source address
match ipv4 destination address
match ipv4 protocol
collect counter bytes
collect timestamp absolute first
! 2. Configure a FLOW EXPORTER - source interface being monitored, destination of a COLLECTOR, and a UDP port
flow exporter lab-ipv4
destination 172.31.100.10
source GigabitEthernet26
transport udp 2055
! 3. Set a FLOW MONITOR - include the RECORD and EXPORTER
flow monitor lab-ipv4
record lab-ipv4
exporter lab-ipv4
! If no packets are seen for 20s, age out and prepare to export
cache timeout inactive 20
! For a continuous flow, break it into chunks and export data every 60 seconds
cache timeout active 60
! 4. (Optional) Configure a Sampler to reduce the CPU and memory load - Pick a random packet from 100 packets
sampler lab-ipv4
mode random 1 out-of 100
! 5. Apply the Flow Monitor & Sampler to the monitored (source) interface
interface GigabitEthernet26
ip flow monitor lab-ipv4 sampler lab-ipv4 output
ip address 172.31.100.21 255.255.255.0
negotiation auto