Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

• You are familiar with the Flexible NetFlow key fields as they are defined in the following commands in the Cisco IOS Flexible NetFlow Command Reference :

  • match flow
  • match interface
  • match {ipv4 | ipv6}
  • match routing
  • match transport
• You are familiar with the Flexible NetFlow nonkey fields as they are defined in the following commands in the Cisco IOS Flexible NetFlow Command Reference :

  • collect counter
  • collect flow
  • collect interface
  • collect{ipv4 | ipv6}
  • collect routing
  • collect timestamp sys-uptime
  • collect transport
• The networking device must be running a Cisco release that supports Flexible NetFlow.

Flexible NetFlow facilitates the creation of more complex configurations for traffic analysis and data export through the use of reusable configuration components.

NetFlow is typically used for several key customer applications, including the following:

• Network monitoring. NetFlow data enables extensive near-real-time network monitoring capabilities. Flow-based analysis techniques are used by network operators to visualize traffic patterns associated with individual routers and switches and network-wide traffic patterns (providing aggregate traffic or application-based views) to provide proactive problem detection, efficient troubleshooting, and rapid problem resolution.
• Application monitoring and profiling. NetFlow data enables network managers to gain a detailed time-based view of application usage over the network. This information is used to plan, understand new services, and allocate network and application resources (for example, web server sizing and VoIP deployment) to meet customer demands responsively.
• User monitoring and profiling. NetFlow data enables network engineers to gain detailed understanding of customer and user use of network and application resources. This information may then be used to efficiently plan and allocate access, backbone, and application resources and to detect and resolve potential security and policy violations.
• Network planning. NetFlow can be used to capture data over a long period of time, affording the opportunity to track and anticipate network growth and plan upgrades to increase the number of routing devices, ports, and higher-bandwidth interfaces. NetFlow services data optimizes network planning for peering, backbone upgrades, and routing policy. NetFlow helps to minimize the total cost of network operations while maximizing network performance, capacity, and reliability. NetFlow detects unwanted WAN traffic, validates bandwidth and quality of service (QoS), and allows the analysis of new network applications. NetFlow will give you valuable information to reduce the cost of operating your network.
• Security analysis. NetFlow identifies and classifies distributed denial of service (dDoS) attacks, viruses, and worms in real time. Changes in network behavior indicate anomalies that are clearly demonstrated in Flexible NetFlow data. The data is also a valuable forensic tool to understand and replay the history of security incidents.
• Billing and accounting. NetFlow data provides fine-grained metering (for instance, flow data includes details such as IP addresses, packet and byte counts, time stamps, type of service (ToS), and application ports) for highly flexible and detailed resource utilization accounting. Service providers may use the information for billing based on time of day, bandwidth usage, application usage, quality of service, and so on. Enterprise customers may use the information for departmental charge back or cost allocation for resource utilization.
• NetFlow data warehousing and data mining. NetFlow data (or derived information) can be warehoused for later retrieval and analysis in support of proactive marketing and customer service programs (for example, discovering which applications and services are being used by internal and external users and targeting them for improved service, advertising, and so on). In addition, Flexible NetFlow data gives market researchers access to the "who," "what," "where," and "how long" information relevant to enterprises and service providers.

Original NetFlow and Flexible NetFlow both use the concept of flows. A flow is defined as a stream of packets between a given source and a given destination.

Original NetFlow and Flexible NetFlow both use the values in key fields in IP datagrams, such as the IP source or destination address and the source or destination transport protocol port, as the criteria for determining when a new flow must be created in the cache while network traffic is being monitored. When the value of the data in the key field of a datagram is unique with respect to the flows that already exist, a new flow is created.

Original NetFlow and Flexible NetFlow both use nonkey fields as the criteria for identifying fields from which data is captured from the flows. The flows are populated with data that is captured from the values in the nonkey fields.

The figure below is an example of the process for inspecting packets and creating flow records in the cache. In this example, two unique flows are created in the cache because different values are in the source and destination IP address key fields.

Figure 1. Packet Inspection

Original NetFlow uses a fixed seven tuples of IP information to identify a flow. Flexible NetFlow allows the flow to be user defined. The benefits of Flexible NetFlow include:

• High-capacity flow recognition, including scalability and aggregation of flow information.
• Enhanced flow infrastructure for security monitoring and dDoS detection and identification.
• New information from packets to adapt flow information to a particular service or operation in the network. The flow information available will be customizable by Flexible NetFlow users.
• Extensive use of Cisco’s flexible and extensible NetFlow Version 9 export format.
• A comprehensive IP accounting feature that can be used to replace many accounting features, such as IP accounting, Border Gateway Protocol (BGP) Policy Accounting, and persistent caches.

Original NetFlow allows you to understand the activities in the network and thus to optimize network design and reduce operational costs. Flexible NetFlow allows you to understand network behavior with more efficiency, with specific flow information tailored for various services used in the network. The following are some example applications for a Flexible NetFlow feature:

• Flexible NetFlow enhances Cisco NetFlow as a security monitoring tool. For instance, new flow keys can be defined for packet length or MAC address, allowing users to search for a specific type of attack in the network.
• Flexible NetFlow allows you to quickly identify how much application traffic is being sent between hosts by specifically tracking TCP or UDP applications by the class of service (CoS) in the packets.
• The accounting of traffic entering a Multiprotocol Label Switching (MPLS) or IP core network and its destination for each next hop per class of service. This capability allows the building of an edge-to-edge traffic matrix.

The figure below is an example of how Flexible NetFlow might be deployed in a network.

Figure 2. Typical Deployment for Flexible NetFlow

Flexible NetFlow consists of components that can be used together in several variations to perform traffic analysis and data export. The user-defined flow records and the component structure of Flexible NetFlow facilitates the creation of various configurations for traffic analysis and data export on a networking device with a minimum number of configuration commands. Each flow monitor can have a unique combination of flow record, flow exporter, and cache type. If you change a parameter such as the destination IP address for a flow exporter, it is automatically changed for all the flow monitors that use the flow exporter. The same flow monitor can be used in conjunction with different flow samplers to sample the same type of network traffic at different rates on different interfaces. The following sections provide more information on Flexible NetFlow components:

Note	Starting from Cisco IOS XE Release 3.10S, the number of configurable flow record fields have been increased from 32 to 40.

Flexible NetFlow can be used as a network attack detection tool with capabilities to track all parts of the IP header and even packet sections and characterize this information into flows. Security monitoring systems can analyze Flexible NetFlow data, and upon finding an issue in the network, create a virtual bucket or virtual cache that will be configured to track specific information and identify details about the attack pattern or worm propagation. The capability to create caches dynamically with specific information combined with input filtering (for example, filtering all flows to a specific destination) makes Flexible NetFlow a powerful security monitoring tool.

One common type of attack occurs when TCP flags are used to flood open TCP requests to a destination server (for example, a SYN flood attack). The attacking device sends a stream of TCP SYNs to a given destination address but never sends the ACK in response to the servers SYN-ACK as part of the TCP three-way handshake. The flow information needed for a security detection server requires the tracking of three key fields: destination address or subnet, TCP flags, and packet count. The security detection server may be monitoring general Flexible NetFlow information, and this data may trigger a detailed view of this particular attack by the Flexible NetFlow dynamically creating a new flow monitor in the router’s configuration. The new flow monitor might include input filtering to limit what traffic is visible in the Flexible NetFlow cache along with the tracking of the specific information to diagnose the TCP-based attack. In this case the user may want to filter all flow information to the server destination address or subnet to limit the amount of information the security detection server needs to evaluate. If the security detection server decided it understood this attack, it might then program another flow monitor to collect and export payload information or sections of packets to take a deeper look at a signature within the packet. This example is just one of many possible ways that Flexible NetFlow can be used to detect security incidents.

If the predefined Flexible NetFlow records are not suitable for your traffic requirements, you can create a user-defined (custom) record using the Flexible NetFlow collect and match commands. Before you can create a customized record, you must decide the criteria that you are going to use for the key and nonkey fields.

If you want to create a customized record for detecting network attacks, you must include the appropriate key and nonkey fields in the record to ensure that the router creates the flows and captures the data that you need to analyze the attack and respond to it. For example, SYN flood attacks are a common denial of service (DoS) attack in which TCP flags are used to flood open TCP requests to a destination host. When a normal TCP connection starts, a destination host receives a SYN (synchronize/start) packet from a source host and sends back a SYN ACK (synchronize acknowledge). The destination host must then hear an ACK (acknowledge) of the SYN ACK before the connection is established. This is referred to as the "TCP three-way handshake While the destination host waits for the ACK to the SYN ACK, a connection queue of finite size on the destination host keeps track of connections waiting to be completed. This queue typically empties quickly because the ACK is expected to arrive a few milliseconds after the SYN ACK. The TCP SYN attack exploits this design by having an attacking source host generate TCP SYN packets with random source addresses toward a victim host. The victim destination host sends a SYN ACK back to the random source address and adds an entry to the connection queue. Because the SYN ACK is destined for an incorrect or nonexistent host, the last part of the TCP three-way handshake is never completed and the entry remains in the connection queue until a timer expires, typically for about one minute. When the source host rapidly generates TCP SYN packets from random IP addresses, the connection queue can be filled and TCP services (such as e-mail, file transfer, or WWW) can be denied to legitimate users.

The information needed for a security monitoring record for this type of DoS attack might include the following key and nonkey fields:

• Key fields:

  • Destination IP address or destination IP subnet
  • TCP flags
  • Packet count
• Nonkey fields

  • Destination IP address
  • Source IP address
  • Interface input and output

Tip	Many users configure a general Flexible NetFlow monitor that triggers a more detailed Flexible NetFlow view of a DoS attack using these key and nonkey fields.

Emulating original NetFlow with Flexible NetFlow enables to you to deploy Flexible NetFlow quickly because you can use a predefined record instead of designing and configuring a custom user-defined record. You need only configure a flow monitor and apply it to an interface for Flexible NetFlow to start working like original NetFlow. You can add an optional exporter if you want to analyze the data that you collect with an application such as NetFlow collector.

Each flow monitor has a separate cache assigned to it. Each flow monitor requires a record to define the contents and layout of its cache entries. The record format can be one of the predefined record formats, or an advanced user may create his or her own record format using the collect and matchcommands in Flexible NetFlow flow record configuration mode.

Flow exporters are used to send the data that you collect with Flexible NetFlow to a remote system such as a NetFlow Collection Engine. Exporters use UDP as the transport protocol and use the Version 9 export format.

If you are familiar with original NetFlow, you already understand the format and content of the data that you collect and export with Flexible NetFlow when you emulate original NetFlow. You will be able to use the same techniques for analyzing the data.

Flexible NetFlow predefined records are based on the original NetFlow ingress and egress caches and the aggregation caches. The difference between the original NetFlow aggregation caches and the corresponding predefined Flexible NetFlow records is that the predefined records do not perform aggregation. Flexible NetFlow predefined records are associated with a Flexible NetFlow flow monitor the same way that you associate a user-defined (custom) record.

1.    enable


2.    configure terminal


3.    flow record record-name


4.    description description


5.    match {ipv4 | ipv6} {destination | source} address


6.    Repeat Step 5 as required to configure additional key fields for the record.

7.    collect interface {input | output}


8.    Repeat Step 7 as required to configure additional nonkey fields for the record.

9.    end


10.    show flow record record-name


11.    show running-config flow record record-name

Device> enable

Device# configure terminal

Device(config)# flow record FLOW-RECORD-1

Device(config-flow-record)# description Used for basic traffic analysis

Device(config-flow-record)# match ipv4 destination address

Device(config-flow-record)# collect interface input

Device(config-flow-record)# end

Device# show flow record FLOW_RECORD-1

Device# show running-config flow record FLOW_RECORD-1 

1.    enable


2.    show flow record

Device> enable
Device#

Device# show flow record

flow record FLOW-RECORD-2:
  Description:        Used for basic IPv6 traffic analysis
  No. of users:       1
  Total field space:  53 bytes
  Fields:
    match ipv6 destination address
    collect counter bytes
    collect counter packets
flow record FLOW-RECORD-1:
  Description:        Used for basic IPv4 traffic analysis
  No. of users:       1
  Total field space:  29 bytes
  Fields:
    match ipv4 destination address
    collect counter bytes
    collect counter packets

1.    enable


2.    show running-config flow record

Device> enable
Device#

Device# show running-config flow record

Current configuration:
!
flow record FLOW-RECORD-2
 description Used for basic IPv6 traffic analysis
 match ipv6 destination address
 collect counter bytes
 collect counter packets
!
flow record FLOW-RECORD-1
 description Used for basic IPv4 traffic analysis
 match ipv4 destination address
 collect counter bytes
 collect counter packets
 collect timestamp sys-uptime first
 collect timestamp sys-uptime last
!

To configure a flow monitor for IPv4/IPv6 traffic using the Flexible NetFlow "NetFlow IPv4/IPv6 original input" predefined record for the flow monitor, perform the following required task.

Each flow monitor has a separate cache assigned to it. Each flow monitor requires a record to define the contents and layout of its cache entries. The record format can be one of the predefined record formats, or an advanced user may create his or her own record format using the collect and matchcommands in Flexible NetFlow flow record configuration mode.

Note	You must remove a flow monitor from all of the interfaces to which you have applied it before you can modify the record format of the flow monitor.

1.    enable


2.    configure terminal


3.    flow monitor monitor-name


4.    description description


5.    record netflow {ipv4 | ipv6} original-input


6.    end


7.    show flow monitor [[name] monitor-name [cache [format {csv | record | table}]][statistics]]


8.    show running-config flow monitor monitor-name

Device> enable

Device# configure terminal

Device(config)# flow monitor FLOW-MONITOR-1

Device(config-flow-monitor)# description Used for monitoring IPv4 traffic

Device(config-flow-monitor)# record netflow ipv4 original-input 

Device(config-flow-monitor)# end

Device# show flow monitor FLOW-MONITOR-2 cache

Device# show flow monitor FLOW_MONITOR-1

Perform this optional task to configure a flow exporter for the flow monitor in order to export the data that is collected by Flexible NetFlow to a remote system for further analysis and storage.

Flow exporters are used to send the data that you collect with Flexible NetFlow to a remote system such as a NetFlow Collection Engine. Exporters use UDP as the transport protocol and use the Version 9 export format.

Note	Each flow exporter supports only one destination. If you want to export the data to multiple destinations, you must configure multiple flow exporters and assign them to the flow monitor. You can export to a destination using either an IPv4 or IPv6 address.

1.    enable


2.    configure terminal


3.    flow exporter exporter-name


4.    description description


5.    destination {hostname | ip-address} [vrf vrf-name]


6.    export-protocol {netflow-v5 | netflow-v9 | ipfix}


7.    transport udp udp-port


8.    exit


9.    flow monitor flow-monitor-name


10.    exporter exporter-name


11.    end


12.    show flow exporter exporter-name


13.    show running-config flow exporter exporter-name

Device> enable

Device# configure terminal

Device(config)# flow exporter EXPORTER-1

Device(config-flow-exporter)# description Exports to datacenter

Device(config-flow-exporter)# destination 172.16.10.2

Device(config-flow-exporter)# export-protocol netflow-v9

Device(config-flow-exporter)# transport udp 65

Device(config-flow-exporter)# exit

Device(config)# flow monitor FLOW-MONITOR-1

Device(config-flow-monitor)# exporter EXPORTER-1 

Device(config-flow-monitor)# end

Device# show flow exporter FLOW_EXPORTER-1

Device<# show running-config flow exporter FLOW_EXPORTER-1 

Before You Begin

If you want to use a customized record instead of using one of the Flexible NetFlow predefined records, you must create the customized record before you can perform this task.

If you want to add a flow exporter to the flow monitor for data export, you must create the exporter before you can complete this task.

Note

You must use the no ip flow monitor command to remove a flow monitor from all of the interfaces to which you have applied it before you can modify the parameters for the record command on the flow monitor. For information about the ip flow monitor command, refer to the Cisco IOS Flexible NetFlow Command Reference.

1.    enable


2.    configure terminal


3.    flow monitor monitor-name


4.    description description


5.    record {record-name | netflow-original | netflow {ipv4 | ipv6} record [peer]}


6.    cache {entries number | timeout {active | inactive | update} seconds | type {immediate | normal | permanent}}


7.    Repeat Step 6 as required to finish modifying the cache parameters for this flow monitor.

8.    statistics packet protocol


9.    statistics packet size


10.    exporter exporter-name


11.    end


12.    show flow monitor [[name] monitor-name [cache [format {csv | record | table}]] [statistics]]


13.    show running-config flow monitor monitor-name

Device> enable

Device# configure terminal

Device(config)# flow monitor FLOW-MONITOR-1

Device(config-flow-monitor)# description Used for basic ipv4 traffic analysis

Device(config-flow-monitor)# record FLOW-RECORD-1

Device(config-flow-monitor)# cache type normal

Device(config-flow-monitor)# statistics packet protocol

Device(config-flow-monitor)# statistics packet size

Device(config-flow-monitor)# exporter EXPORTER-1 

Device(config-flow-monitor)# end

Device# show flow monitor FLOW-MONITOR-2 cache

Device# show running-config flow monitor FLOW_MONITOR-1

1.    enable


2.    show flow monitor monitor-name

Device> enable
Device#

Device# show flow monitor FLOW-MONITOR-1

Flow Monitor FLOW-MONITOR-1:
  Description:       Used for basic ipv4 traffic analysis
  Flow Record:       FLOW-RECORD-1
  Flow Exporter:     EXPORTER-1
  Cache:
    Type:              normal
    Status:            allocated
    Size:              1000 entries / 50052 bytes
    Inactive Timeout:  15 secs
    Active Timeout:    1800 secs
    Update Timeout:    1800 secs
  

1.    enable


2.    show flow monitor name monitor-name cache format record

Device> enable
Device#

Device# show flow monitor name FLOW-MONITOR-1 cache format record

Cache type:                            Normal
  Cache size:                              1000
  Current entries:                            4
  High Watermark:                             4
  Flows added:                              101
  Flows aged:                                97
    - Active timeout   (  1800 secs)          3
    - Inactive timeout (    15 secs)         94
    - Event aged                              0
    - Watermark aged                          0
    - Emergency aged                          0
IPV4 DESTINATION ADDRESS:  172.16.10.5
ipv4 source address:       10.10.11.1
trns source port:          25
trns destination port:     25
counter bytes:             72840
counter packets:           1821
IPV4 DESTINATION ADDRESS:  172.16.10.2
ipv4 source address:       10.10.10.2
trns source port:          20
trns destination port:     20
counter bytes:             3913860
counter packets:           7326
IPV4 DESTINATION ADDRESS:  172.16.10.200
ipv4 source address:       192.168.67.6
trns source port:          0
trns destination port:     3073
counter bytes:             51072
counter packets:           1824

Device# show flow monitor name FLOW-MONITOR-2 cache format record

Cache type:                            Normal
  Cache size:                              1000
  Current entries:                            2
  High Watermark:                             3
  Flows added:                               95
  Flows aged:                                93
    - Active timeout   (  1800 secs)          0
    - Inactive timeout (    15 secs)         93
    - Event aged                              0
    - Watermark aged                          0
    - Emergency aged                          0
IPV6 DESTINATION ADDRESS:  2001:DB8:4:ABCD::2
ipv6 source address:       2001:DB8:1:ABCD::1
trns source port:          33572
trns destination port:     23
counter bytes:             19140
counter packets:           349
IPV6 DESTINATION ADDRESS:  FF02::9
ipv6 source address:       FE80::A8AA:BBFF:FEBB:CC03
trns source port:          521
trns destination port:     521
counter bytes:             92
counter packets:           1

1.    enable


2.    show running-config flow monitor

Device> enable
Device#

Device# show running-config flow monitor FLOW-MONITOR-1

Current configuration:
!
flow monitor FLOW-MONITOR-1
 description Used for basic ipv4 traffic analysis
 record FLOW-RECORD-1
 exporter EXPORTER-1
 cache entries 1000
!

1.    enable


2.    configure terminal


3.    interface type number


4.    {ip | ipv6} flow monitor monitor-name {input | output}

5.    Repeat Steps 3 and 4 to activate a flow monitor on any other interfaces in the device over which you want to monitor traffic.

6.    end


7.    show flow interface type number


8.    show flow monitor name monitor-name cache format record

Device> enable

Device# configure terminal

Device(config)# interface GigabitEthernet 0/0/0

Device(config-if)# ip flow monitor FLOW-MONITOR-1 input

Device(config-if)# end

Device# show flow interface GigabitEthernet 0/0/0

Device# show flow monitor name FLOW_MONITOR-1 cache format record

1.    enable


2.    show flow interface type number

Device> enable
Device#

Device# show flow interface GigabitEthernet 0/0/0

Interface GigabitEthernet0/0/0
  FNF:  monitor:         FLOW-MONITOR-1
        direction:       Input
        traffic(ip):     on
  FNF:  monitor:         FLOW-MONITOR-2
        direction:       Input
        traffic(ipv6):   on
Device# show flow interface GigabitEthernet 1/0/0
Interface GigabitEthernet1/0/0
  FNF:  monitor:         FLOW-MONITOR-1
        direction:       Output
        traffic(ip):     on
  FNF:  monitor:         FLOW-MONITOR-2
        direction:       Input
        traffic(ipv6):   on