The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
A NetFlow flow is a unidirectional sequence of packets that arrive on a single interface (or subinterface), and have the same values for key fields.
NetFlow is useful for the following:
Accounting/Billing—NetFlow data provides fine grained metering for highly flexible and detailed resource utilization accounting.
Network Planning and Analysis—NetFlow data provides key information for strategic network planning.
Network Monitoring—NetFlow data enables near real-time network monitoring capabilities.
|
Release |
Modification |
|---|---|
|
Release 5.0.0 |
This feature was introduced. |
This module includes these sections:
To perform these configuration tasks, your Cisco IOS XR software system administrator must assign you to a user group associated with a task group that includes the corresponding command task IDs. If you need assistance with your task group assignment, contact your system administrator.
Consider these restrictions when configuring NetFlow in Cisco IOS XR software:
A source interface must always be configured. If you do not configure a source interface, the exporter will remain in a disabled state.
The export format Version 9 and IPFIX is supported.
A valid record map name must always be configured for every flow monitor map.
The input interface of a router is updated with a nonzero value for all the egress ICMP replies.
PW-Ether interface doesn't support IPv6/MPLS NetFlow sampling.
 Tip |
Don’t use the management interface to export the NetFlow packets. |
A flow is exported as part of a NetFlow export User Datagram Protocol (UDP) datagram under these circumstances:
The flow has been inactive or active for too long.
The flow cache is getting full.
One of the counters (packets and or bytes) has wrapped.
The user forces the flow to export.
NetFlow export UDP datagrams are sent to an external flow collector device that provides NetFlow export data filtering and aggregation. The export of data consists of expired flows and control information.
The NetFlow infrastructure is based on the configuration and use of these maps:
Exporter map
Monitor map
Sampler map
These maps are described in the sections that follow.
An exporter map contains user network specification and transport layer details for the NetFlow export packet. The flow exporter-map command allows you to configure collector and version attributes. You can configure these collector information:
Export destination IP address
DSCP value for export packet
Source interface
UDP port number (This is where the collector is listening for NetFlow packets.)
Transport protocol for export packets
 Note |
In Cisco IOS XR Software, UDP is the only supported transport protocol for export packets. |
Note |
NetFlow export packets use the IP address that is assigned to the source interface. If the source interface does not have an IP address assigned to it, the exporter will be inactive. |
You can also configure these export version attributes:
Template timeout
Template data timeout
Template options timeout
Interface table timeout
Sampler table timeout
Note |
A single flow monitor map can support up to eight exporters. |
A monitor map contains name references to the flow record map and flow exporter map. Monitor maps are applied to an interface. You can configure these monitor map attributes:
Number of entries in the flow cache
Type of cache (permanent or normal); permanent caches entries aren’t removed from the cache unless they are explicitly cleared by the user.
Active flow timeout
Inactive flow timeout
Update timeout
Default timeouts
Record type of packets sampled and collected
Note |
The record name specifies the type of packets that NetFlow samples as they pass through the router. Currently, MPLS, IPv4, and IPv6 packet sampling are supported. |
Note |
The active flow and inactive flow timeouts are associated with a normal cache type. The update timeout is associated with the permanent cache type. |
The sampler map specifies the rate at which packets (one out of n packets) are sampled. On high bandwidth interfaces, applying NetFlow processing to every single packet can result in significant CPU utilization. Sampler map configuration is typically geared towards such high speed interfaces. However, in order to find out the best sampling rate for the device, use the below sampling rate formula:
If NetFlow is applied in both directions, then the flow record packets are policed at the rate of 500,000 packets per second per direction. If NetFlow is applied in one direction only, then the flow record packets are policed at the rate of 1,000,000 packets per second per direction.
NetFlow version 9 is a template-based version. The templates provide an extensible design to the record format. This feature allows enhancements to NetFlow services without requiring concurrent changes to the basic flow-record format. An options template is a special type of template record that is used to communicate the format of data related to the NetFlow process. Rather than supplying information about IP flows, the options are used to supply metadata about the NetFlow process itself. The sampler options template and the interface options template are different forms of options templates. These two tables are exported by the NetFlow process. From release 5.2.0, the NetFlow process will also export the VRF table.
The sampler options template consists of sampler tables. Similarly, the interface option templates consist of interface tables. By enabling the options for sampler table and interface table, it becomes easier for the collector to determine the information on data flow.
| Field Name | Value |
|---|---|
|
FlowSamplerID |
This ID is assigned to the sampler. It is used by the collector to retrieve information about the sampler for a data flow record. |
|
FlowSamplerMode |
This field indicates the mode in which the sampling has been performed. The default value for this field is 1 for deterministic sampling and 2 for random sampling. |
|
FlowSamplerRandomInterval |
This field indicates the rate at which the sampling is performed. |
|
SamplerName |
This field indicates the name of the sampler. |
The interface table consists of information on interfaces that are being monitored for data flow. By using this information, the collector determines the names of interfaces associated with the data flow. The interface table consists of the following information:
| Field Name | Value |
|---|---|
|
ingressInterface |
This field indicates the SNMP index assigned to the interface. By matching this value to the Ingress interface and the Egress Interface in the data flow record, the collector is able to retrieve the name of the interface. |
|
interfaceDescription |
This field indicates the name of the interface. |
The VRF table consists of mapping of VRF IDs to the VRF names. By using this information, the collector determines the name of the required VRF. The VRF table consists of the following information:
| Field Name | Value |
|---|---|
|
ingressVRFID |
The identifier of the VRF with the name in the VRF-Name field. |
|
VRF-Name |
The VRF name which has the VRFID value ingressVRFID. The value "default" indicates that the interface is not assigned explicitly to a VRF. |
The data records contain ingressVRFID and egressVRFID fields as extra fields in each record. The values of these fields are used to lookup the VRF Table to find the VRF names. A value 0 in these fields indicates that the VRF is unknown.
The VRF table is exported at intervals specified by the optional timeout keyword that can be configured manually. The default value is 1800 seconds.
In Cisco IOS XR Software, NetFlow map configuration takes place in map-specific submodes. Cisco IOS XR Software supports these NetFlow map configuration submodes:
Note |
The Cisco IOS XR Software allows you to issue most commands available under submodes as one single command string from XR Config mode. For example, you can issue the record ipv4 command from the flow monitor map configuration submode as follows: |
RP/0/RP0/CPU0:router(config)# flow monitor-map fmm
RP/0/RP0/CPU0:router(config-fmm)# record ipv4
Alternatively, you can issue the same command from global configuration mode, as shown in the following example:
RP/0/RP0/CPU0:router(config)# flow monitor-map fmm record ipv4
When you issue the flow exporter-map fem-name command in XR Config mode, the command-line interface (CLI) prompt changes to “config-fem,” indicating that you have entered the flow exporter map configuration submode.
In this sample output, the question mark (?) online help function displays all the commands available under the flow exporter map configuration submode:
RP/0/RP0/CPU0:router(config)# flow exporter-map fem
RP/0/RP0/CPU0:router(config-fem)# ?
clear Clear the uncommitted configuration
clear Clear the configuration
commit Commit the configuration changes to running
describe Describe a command without taking real actions
destination Export destination configuration
do Run an exec command
dscp Specify DSCP value for export packets
exit Exit from this submode
no Negate a command or set its defaults
pwd Commands used to reach current submode
root Exit to the global configuration mode
show Show contents of configuration
source Source interface
transport Specify the transport protocol for export packets
version Specify export version parameters
Note |
If you enter the version command, you enter the flow exporter map version configuration submode. |
Note |
A single flow monitor map can support up to eight exporters. |
When you issue the version v9 command in the flow exporter map configuration submode, the CLI prompt changes to “config-fem-ver,” indicating that you have entered the flow exporter map version configuration submode.
In this sample output, the question mark (?) online help function displays all the commands available under the flow exporter map version configuration submode:
RP/0/RP0/CPU0:router(config-fem)# version v9
RP/0/RP0/CPU0:router(config-fem-ver)# ?
commit Commit the configuration changes to running
describe Describe a command without taking real actions
do Run an exec command
exit Exit from this submode
no Negate a command or set its defaults
options Specify export of options template
show Show contents of configuration
template Specify template export parameters
When you issue the flow monitor-map map_name command in XR Config mode, the CLI prompt changes to “config-fmm,” indicating that you have entered the flow monitor map configuration submode.
In this sample output, the question mark (?) online help function displays all the commands available under the flow monitor map configuration submode:
RP/0/RP0/CPU0:router(config)# flow monitor-map fmm
RP/0/RP0/CPU0:router(config-fmm)# ?
cache Specify flow cache attributes
commit Commit the configuration changes to running
describe Describe a command without taking real actions
do Run an exec command
exit Exit from this submode
exporter Specify flow exporter map name
no Negate a command or set its defaults
record Specify a flow record map name
show Show contents of configuration
When you issue the sampler-map map_name command in XR Config mode, the CLI prompt changes to “config-sm,” indicating that you have entered the sampler map configuration submode.
In this sample output, the question mark (?) online help function displays all the commands available under the sampler map configuration submode:
RP/0/RP0/CPU0:router(config)# sampler-map fmm
RP/0/RP0/CPU0:router(config-sm)# ?
clear Clear the uncommitted configuration
clear Clear the configuration
commit Commit the configuration changes to running
describe Describe a command without taking real actions
do Run an exec command
exit Exit from this submode
no Negate a command or set its defaults
pwd Commands used to reach current submode
random Use random mode for sampling packets
root Exit to the global configuration mode
show Show contents of configuration
Use the bgp attribute-download command to enable NetFlow BGP routing attribute collection. The routing attributes are then exported. When no routing attributes are collected, zeroes (0) are exported.
When BGP attribute download is enabled, BGP downloads the attribute information for prefixes (community, extended community, and as-path) to the Routing Information Base (RIB) and Forwarding Information Base (FIB). This enables FIB to associate the prefixes with attributes and send the NetFlow statistics along with the associated attributes.
Cisco IOS XR Software supports the NetFlow collection of MPLS packets. It also supports the NetFlow collection of MPLS packets carrying IPv4, IPv6, or both IPv4 and IPv6 payloads.
In Cisco IOS XR Software, at a time, you can have only one MPLS flow monitor running on an interface. If you apply an additional MPLS flow monitor to the interface, the new flow monitor overwrites the existing one.
At a time, you can apply only one flow monitor on an interface per direction. You can apply either the same flow monitor to an interface in both directions, or each direction can have its own flow monitor.
You can configure the MPLS flow monitor to collect IPv4 fields, IPv6 fields, or IPv4-IPv6 fields. IPv4-IPv6 configuration collects both IPv4 and IPv6 addresses using one MPLS flow monitor. IPv4 configuration collects only IPv4 addresses. IPv6 configuration collects only IPv6 addresses.
The MPLS flow monitor supports up to 1,000,000 cache entries. NetFlow entries include these types of fields:
IPv4 fields
IPv6 fields
MPLS with IPv4 fields
MPLS with IPv6 fields
The maximum number of bytes per NetFlow cache entry is as follows:
IPv4–88 bytes per entry
MPLS–88 bytes per entry
IPv6–108 bytes per entry
MPLS with IPv4 fields–108 bytes per entry
MPLS with IPv6 fields–128 bytes per entry
Note |
The different types of NetFlow entries are stored in separate caches. Consequently, the number of NetFlow entries on a line card can significantly impact the amount of available memory on the line card. Also, even though the sampling rate for IPv6 is the same as the sampling rate for IPv4, the CPU utilization for IPv6 is higher due to the longer keys used by the IPv6 fields. |
The collection of IPv6 flows in MPLS packets is an option. The CPU uses 128 bytes for each IPv6 field. IPv6 flows may contain these types of information:
Source IP address
Destination IP address
Traffic class value
Layer 4 protocol number
Layer 4 source port number
Layer 4 destination port number
Flow ID
Header option mask
To collect the IPv6 fields in MPLS packets, you must activate the MPLS record type, ipv6-fields by running the record mpls ipv6-fields command. You can also specify the number of labels to be used for aggregation with this command.
Destination-based NetFlow accounting (DBA) is a usage-based billing application that tracks and records traffic according to its destination. It enables service providers to do destination-specific accounting and billing. The destination-based NetFlow accounting record includes the destination peer autonomous system (AS) number and the BGP next-hop IP address.
Note |
When an EBGP neighborship is established towards a directly connected peer (neighborship toward's the Peer routers Global IPv6 address configured on the directly connected interface), the EBGPv6 peer will advertise both the Link Local Next Hop (LL NH) and the Global Next Hop. |
In destination-based NetFlow accounting, these parameters are collected and exported to destination:
Destination peer AS number
BGP next-hop IP address
Ingress interface
Egress interface
Forwarding status
Destination-based NetFlow accounting supports:
Only IPv4 addresses
Configuration on physical interfaces, bundle interfaces, and logical subinterfaces
IPv4 unicast and multicast traffic
Only ingress traffic
Only full mode NetFlow
NetFlow export format Version 9 over User Datagram Protocols (UDPs)
Destination-based NetFlow accounting does not support:
IPv6 addresses
MPLS IPv4 and IPv6
Configuration for individual Modular QoS Command-Line Interface (MQC) classes
Simultaneous configuration of destination-based NetFlow accounting with IPv4 sampled NetFlow on the same interface, in the same direction.
Layer 2 switched MPLS traffic
Egress traffic
Sampled mode NetFlow
NetFlow export formats version 5, version 8, IP Flow Information Export (IPFIX), or Stream Control Transmission Protocol (SCTP).
The steps that follow provide a general overview of NetFlow configuration:
|
Step 1 |
Create and configure an exporter map. |
||
|
Step 2 |
Create and configure a monitor map and a sampler map.
|
||
|
Step 3 |
Apply the monitor map and sampler map to an interface. These steps are described in detail in these sections: |
Configure an exporter map and apply it to the monitor map with the flow monitor-map map_name exporter map_name command. You can configure the exporter map prior to configuring the monitor map, or you can configure the monitor map first and then configure and apply an exporter map later on.
Note |
Cisco IOS XR Software supports the configuration of a single collector only in the exporter map. |
The steps that follow describe how to create and configure an exporter map and enable exporting of the sampler table or the interface table.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure |
|
|
Step 2 |
flow exporter-map map_name Example: |
Creates an exporter map, configures the exporter map name, and enters flow exporter map configuration mode. |
|
Step 3 |
destination hostname_or_IP_address Example: |
Configures the export destination for the flow exporter map. The destination can be a hostname or an IPv4 address. |
|
Step 4 |
dscp dscp_value Example: |
(Optional) Specifies the differentiated services codepoint (DSCP) value for export packets. Replace the dscp_value argument with a value in the range from 0 through 63. |
|
Step 5 |
source type interface-path-id Example: |
Specifies a source interface, in the format type interface-path-id . |
|
Step 6 |
transport udp port Example: |
(Optional) Specifies the destination port for UDP packets. Replace port with the destination UDP port value, in the range from 1024 through 65535. |
|
Step 7 |
version v9 Example: |
(Optional) Enters flow exporter map version configuration submode. |
|
Step 8 |
options {interface-table | sampler-table | vrf-table} [timeout seconds] Example: |
(Optional) Configures the export timeout value for the sampler table. Replace seconds with the export timeout value, in the range from 1 through 604800 seconds. Default is 1800 seconds. |
|
Step 9 |
template [data | options] timeout seconds Example: |
(Optional) Configures the export period for data packets. Replace seconds with the export timeout value, in the range from 1 through 604800 seconds. |
|
Step 10 |
commit |
|
|
Step 11 |
exit Example: |
Exits flow exporter map version configuration submode. |
|
Step 12 |
exit Example: |
Exits XR Config mode. |
|
Step 13 |
show flow exporter-map map_name Example: |
Displays exporter map data. |
Perform these steps to create and configure a sampler map.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure |
|
|
Step 2 |
sampler-map map_name Example: |
Creates a sampler map and enters sampler map configuration mode. Keep the following in mind when configuring a sampler map:
|
|
Step 3 |
random 1 out-of sampling_interval Example: |
Configures the sampling interval to use random mode for sampling packets. Replace the sampling_interval argument with a number, in the range from 1 through 65535 units. |
|
Step 4 |
commit |
|
|
Step 5 |
exit Example: |
Exits sampler map configuration mode and enters the XR Config mode. |
|
Step 6 |
exit Example: |
Exits the XR Config mode and enters XR EXEC mode. |
|
Step 7 |
show sampler-map map_name Example: |
Displays sampler map data. |
Perform these steps to create and configure a monitor map.
| Command or Action | Purpose | |||
|---|---|---|---|---|
|
Step 1 |
configure Example: |
Enters XR Config mode. |
||
|
Step 2 |
flow monitor-map map_name Example: |
Creates a monitor map and configures a monitor map name and enters flow monitor map configuration submode. |
||
|
Step 3 |
Do one of the following:
Example: |
Configures the flow record map name for IPv4, IPv6, or MPLS.
|
||
|
Step 4 |
cache entries number Example: |
(Optional) Configures the number of entries in the flow cache. Replace the number argument with the number of flow entries allowed in the flow cache, in the range from 4096 through 1000000. The default number of cache entries is 65535. |
||
|
Step 5 |
cache permanent Example: |
(Optional) Disables removal of entries from flow cache. |
||
|
Step 6 |
cache timeout {active timeout_value | inactive timeout_value | update timeout_value} Example: |
(Optional) Configures the active, inactive, or update flow cache timeout value.
|
||
|
Step 7 |
exporter map_name Example: |
Associates an exporter map with a monitor map.
|
||
|
Step 8 |
Use the commit or end command. |
commit —Saves the configuration changes and remains within the configuration session.
|
||
|
Step 9 |
exit Example: |
Exits flow monitor map configuration submode. |
||
|
Step 10 |
exit Example: |
Exits XR Config mode. |
||
|
Step 11 |
show flow monitor-map map_name Example: |
Displays flow monitor map data. |
Perform these steps to apply a monitor map and a sampler map to an interface.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure Example: |
Enters XR Config mode. |
|
Step 2 |
interface type number Example: |
Enters interface configuration mode. |
|
Step 3 |
flow [ipv4 | ipv6 | mpls ] monitor monitor_map sampler sampler_map {egress | ingress} Example: |
Associates a monitor map and a sampler map with an interface. Enter ipv4 to enable IPV4 NetFlow on the specified interface. Enter ipv6 to enable IPV6 NetFlow on the specified interface. Enter mpls to enable MPLS-aware NetFlow on the specified interface. |
|
Step 4 |
Use the commit or end command. |
commit —Saves the configuration changes and remains within the configuration session.
|
Perform these steps to clear flow exporter map and flow monitor map data.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
clear flow exporter [exporter_name] {restart | statistics} location node-id Example: |
Clears the flow exporter data. Specify the statistics option to clear exporter statistics. Specify the restart option to export all of the templates that are currently configured on the specified node. |
|
Step 2 |
clear flow monitor [monitor_name] cache [force-export | statistics] location node-id} Example: |
Clears the flow monitor data. Specify the statistics option to clear cache statistics. Specify the force-export option to export the data from cache to server first and then clear the entries from cache. |
Perform these steps to configure NetFlow collection of MPLS packets with IPv6 fields.
| Command or Action | Purpose | |||||
|---|---|---|---|---|---|---|
|
Step 1 |
configure |
|||||
|
Step 2 |
flow exporter-map map_name Example: |
Creates an exporter map, configures the exporter map name, and enters flow exporter map configuration mode. |
||||
|
Step 3 |
version v9 Example: |
(Optional) Enters flow exporter map version configuration submode. |
||||
|
Step 4 |
options {interface-table | sampler-table} [timeout seconds] Example: |
(Optional) Configures the export timeout value for the interface table or the sampler table. Replace seconds with the export timeout value, in the range from 1 through 604800 seconds. The default is 1800 seconds for both the interface table and the sample table. You must perform this step twice to configure the export timeout value for both an interface table and a sample table. |
||||
|
Step 5 |
template [data | options] timeout seconds Example: |
(Optional) Configures the export period for data packets or options packets. Replace seconds with the export timeout value, in the range from 1 through 604800 seconds. You must perform this step twice to configure the export period for both data packets and options packets. |
||||
|
Step 6 |
exit Example: |
Exits flow exporter map version configuration mode, and enters flow exporter map configuration mode. |
||||
|
Step 7 |
transport udp port Example: |
(Optional) Specifies the destination port for UDP packets. Replace port with the destination UDP port value, in the range from 1024 through 65535. |
||||
|
Step 8 |
source type interface-path-id Example: |
Specifies a source interface, in the format type interface-path-id . For example: |
||||
|
Step 9 |
destination hostname_or_IP_address Example: |
Configures the export destination for the flow exporter map. The destination can be a hostname or an IPv4 address. |
||||
|
Step 10 |
exit Example: |
Exits flow exporter map configuration mode, and enters XR Config mode. |
||||
|
Step 11 |
flow monitor-map map_name Example: |
Creates a monitor map and configures a monitor map name and enters flow monitor map configuration submode. |
||||
|
Step 12 |
record mpls [ipv4-ipv6-fields] [labels number] Example: |
Configures the flow record map name for IPv4, IPv6, or MPLS. Use the ipv4-ipv6-fields keyword to collect IPv4 and IPv6 fields in an MPLS-aware NetFlow. |
||||
|
Step 13 |
exporter map_name Example: |
Associates an exporter map with a monitor map.
|
||||
|
Step 14 |
cache entries number Example: |
(Optional) Configures the number of entries in the flow cache. Replace the number argument with the number of flow entries allowed in the flow cache, in the range from 4096 through 1000000. The default number of cache entries is 65535. |
||||
|
Step 15 |
cache timeout {active timeout_value | inactive timeout_value | update timeout_value} Example: |
(Optional) Configures the active, inactive, or update flow cache timeout value.
|
||||
|
Step 16 |
cache permanent Example: |
(Optional) Disables the removal of entries from flow cache. |
||||
|
Step 17 |
exit Example: |
Exits flow monitor map configuration submode. |
||||
|
Step 18 |
sampler-map map_name Example: |
Creates a sampler map and enters sampler map configuration mode. Keep the following in mind when configuring a sampler map:
|
||||
|
Step 19 |
random 1 out-of sampling_interval Example: |
Configures the sampling interval to use random mode for sampling packets. Replace the sampling_interval argument with a number, in the range from 1 through 65535 units. |
||||
|
Step 20 |
exit Example: |
Exits sampler map configuration mode and enters XR Config mode. |
||||
|
Step 21 |
interface type number Example: |
Enters interface configuration mode. |
||||
|
Step 22 |
flow [ipv4 | ipv6 | mpls] monitor monitor_map sampler sampler_map {egress | ingress} Example: |
Associates a monitor map and a sampler map with an interface. Enter ipv4 to enable IPV4 NetFlow on the specified interface. Enter ipv6 to enable IPV6 NetFlow on the specified interface. Enter mpls to enable MPLS-aware NetFlow on the specified interface. |
||||
|
Step 23 |
commit |
|||||
|
Step 24 |
exit Example: |
Exits interface configuration submode for the Ethernet interface. |
||||
|
Step 25 |
exit Example: |
Exits XR Config mode. |
||||
|
Step 26 |
show flow monitor-map map_name Example: |
Displays flow monitor map data. |
||||
|
Step 27 |
show flow exporter-map map_name Example: |
Displays exporter map data. |
Perform these tasks to configure destination-based NetFlow accounting.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure |
|
|
Step 2 |
flow monitor-map map_name Example: |
Creates a monitor map and configures a monitor map name and enters flow monitor map configuration submode. |
|
Step 3 |
record ipv4 Example: |
Configures the flow record for an IPv4 destination-based NetFlow accounting record. The destination keyword specifies that the record is for IPv4 destination-based NetFlow accounting. |
|
Step 4 |
exit Example: |
Exits flow monitor map mode and enters the XR Config mode. |
|
Step 5 |
interface type interface-path-id Example: |
Interface type and physical interface-path-id in the format type rack/slot/module/port . type —POS, Ethernet, ATM, etc. rack —Chassis number of the rack. slot —Physical slot number of the line card or modular services card. module —Module number. A physical layer interface module (PLIM) is always 0. port —Physical port number of the interface. |
|
Step 6 |
flow ipv4 monitor name ingress Example: |
Configures an IPv4 flow monitor for the ingress direction and assigns the name of the monitor. |
|
Step 7 |
commit |
|
|
Step 8 |
show flow monitor-map map_name Example: |
Verifies monitor map data. |
These examples show NetFlow configurations:
This example shows how to create a new sampler map called “fsm1,” which samples 1 out of 65535 packets:
RP/0/RP0/CPU0:router# sampler-map fsm1
RP/0/RP0/CPU0:router(config-sm)# random 1 out-of 65535
RP/0/RP0/CPU0:router(config)# exit
This example shows how to create a new flow exporter map called “fem1,” which uses the version 9 (V9) export format for NetFlow export packets. The data template flow-set is inserted into the V9 export packets once every 10 minutes, and the options interface table flow-set is inserted into the V9 export packet. The export packets are sent to the flow collector destination 10.1.1.1, where the source address is identical to the interface IP address of Loopback 0. The UDP destination port is 1024, and the DSCP value is 10:
RP/0/RP0/CPU0:router(config)# flow exporter-map fem1
RP/0/RP0/CPU0:router(config-fem)# destination 10.1.1.1
RP/0/RP0/CPU0:router(config-fem)# source Loopback 0
RP/0/RP0/CPU0:router(config-fem)# transport udp 1024
RP/0/RP0/CPU0:router(config-fem)# dscp 10
RP/0/RP0/CPU0:router(config-fem)# exit
RP/0/RP0/CPU0:router(config-fem)# version v9
RP/0/RP0/CPU0:router(config-fem-ver)# template data timeout 600
RP/0/RP0/CPU0:router(config-fem-ver)# options interface-table
RP/0/RP0/CPU0:router(config-fem-ver)# exit
This example shows how to create a new flow exporter map called “fem1,” which uses the version 9 (V9) export format for the NetFlow export packets. The data template flow-set is inserted into the V9 export packets once every 10 minutes, and the options sampler table flow-set is inserted into the V9 export packet. The export packets are sent to the flow collector destination 10.1.1.1, where the source address is identical to the interface IP address of Loopback 0. The UDP destination port is 1024, and the DSCP value is 10:
RP/0/RP0/CPU0:router(config)# flow exporter-map fem1
RP/0/RP0/CPU0:router(config-fem)# destination 10.1.1.1
RP/0/RP0/CPU0:router(config-fem)# source Loopback 0
RP/0/RP0/CPU0:router(config-fem)# transport udp 1024
RP/0/RP0/CPU0:router(config-fem)# dscp 10
RP/0/RP0/CPU0:router(config-fem)# exit
RP/0/RP0/CPU0:router(config-fem)# version v9
RP/0/RP0/CPU0:router(config-fem-ver)# template data timeout 600
RP/0/RP0/CPU0:router(config-fem-ver)# options sampler-table
RP/0/RP0/CPU0:router(config-fem-ver)# exit
This example shows how to create a new flow monitor map with name “fmm1”. This flow monitor map references the flow exporter map “fem1,” and sets the flow cache attributes to 10000 cache entries. The active entries from the cache are aged every 30 seconds, while the inactive entries from the cache are aged every 15 seconds. The record map for this monitor map is IPv4:
RP/0/RP0/CPU0:router(config)# flow monitor-map fmm1
RP/0/RP0/CPU0:router(config-fmm)# record ipv4
RP/0/RP0/CPU0:router(config-fmm)# exporter fem1
RP/0/RP0/CPU0:router(config-fmm)# cache entries 10000
RP/0/RP0/CPU0:router(config-fmm)# cache timeout active 30
RP/0/RP0/CPU0:router(config-fmm)# cache timeout inactive 15
RP/0/RP0/CPU0:router(config-fmm)# exit
This example shows how to apply the flow monitor “fmm1”and the sampler “fsm1” to the TenGigE 0/0/0/0 interface in the ingress direction:
RP/0/RP0/CPU0:router(config)# interface HundredGigE 0/3/0/0
RP/0/RP0/CPU0:router(config-if)# flow ipv4 monitor fmm1 sampler fsm1 ingress
RP/0/RP0/CPU0:router(config-if)# exit
This example shows how to configure the NetFlow monitor to collect MPLS packets with IPv6 fields:
RP/0/RP0/CPU0:router# config
RP/0/RP0/CPU0:router(config)# flow exporter-map exp1
RP/0/RP0/CPU0:router(config-fem)# version v9
RP/0/RP0/CPU0:router(config-fem-ver)# options interface-table timeout 300
RP/0/RP0/CPU0:router(config-fem-ver)# options sampler-table timeout 300
RP/0/RP0/CPU0:router(config-fem-ver)# template data timeout 300
RP/0/RP0/CPU0:router(config-fem-ver)# template options timeout 300
RP/0/RP0/CPU0:router(config-fem-ver)# exit
RP/0/RP0/CPU0:router(config-fem)# transport udp 12515
RP/0/RP0/CPU0:router(config-fem)# source Loopback0
RP/0/RP0/CPU0:router(config-fem)# destination 170.1.1.11
RP/0/RP0/CPU0:router(config-fmm)# exit
RP/0/RP0/CPU0:router(config)# flow monitor-map MPLS-IPv6-fmm
RP/0/RP0/CPU0:router(config-fmm)# record mpls ipv6-fields labels 3
RP/0/RP0/CPU0:router(config-fmm)# exporter exp1
RP/0/RP0/CPU0:router(config-fmm)# cache entries 10000
RP/0/RP0/CPU0:router(config-fmm)# cache permanent
RP/0/RP0/CPU0:router(config-fmm)# exit
RP/0/RP0/CPU0:router(config)# sampler-map FSM
RP/0/RP0/CPU0:router(config-sm)# random 1 out-of 65535
RP/0/RP0/CPU0:router(config-sm)# exit
RP/0/RP0/CPU0:router(config)# interface HundredGigE 0/3/0/0
RP/0/RP0/CPU0:router(config-if)# flow mpls monitor MPLS-IPv6-fmm sampler FSM ingress
This configuration collects MPLS traffic, but no payload information is collected.
RP/0/RP0/CPU0:router(config)# flow monitor-map MPLS-fmm
RP/0/RP0/CPU0:router(config-fmm)# record mpls labels 3
RP/0/RP0/CPU0:router(config-fmm)# cache permanent
RP/0/RP0/CPU0:router(config)# exit
RP/0/RP0/CPU0:router(config)# interface HundredGigE 0/3/0/0
RP/0/RP0/CPU0:router(config-if)# flow mpls monitor MPLS-fmm sampler fsm ingress
This configuration collects MPLS traffic with IPv4 payloads. It also collects MPLS traffic without IPv4 payloads, but it populates the IPv4 fields with zeros (0).
RP/0/RP0/CPU0:router(config)# flow monitor-map MPLS-IPv4-fmm
RP/0/RP0/CPU0:router(config-fmm)# record mpls IPv4-fields labels 3
RP/0/RP0/CPU0:router(config-fmm)# cache permanent
RP/0/RP0/CPU0:router(config-fmm)# exit
RP/0/RP0/CPU0:router(config)# interface HundredGigE 0/3/0/0
RP/0/RP0/CPU0:router(config-if)# flow mpls monitor MPLS-IPv4-fmm sampler fsm ingress
This configuration collects MPLS traffic with IPv6 payloads. It also collects MPLS traffic without IPv6 payloads, but it populates the IPv6 fields with zeros (0).
RP/0/RP0/CPU0:router(config)# flow monitor-map MPLS-IPv6-fmm
RP/0/RP0/CPU0:router(config-fmm)# record mpls IPv6-fields labels 3
RP/0/RP0/CPU0:router(config-fmm)# cache permanent
RP/0/RP0/CPU0:router(config-fmm)# exit
RP/0/RP0/CPU0:router(config)# interface HundredGigE 0/3/0/0
RP/0/RP0/CPU0:router(config-if)# flow mpls monitor MPLS-IPv6-fmm sampler fsm ingress
This configuration collects MPLS traffic with both IPv6 and IPv4 fields. It also collects MPLS traffic without IPv4 or IPv6 payloads, but it populates the IPv6 and IPv4 fields with zeros (0).
RP/0/RP0/CPU0:router(config)# flow monitor-map MPLS-IPv4-IPv6-fmm
RP/0/RP0/CPU0:router(config-fmm)# record mpls IPv4-IPv6-fields labels 3
RP/0/RP0/CPU0:router(config-fmm)# cache permanent
RP/0/RP0/CPU0:router(config-fmm)# exit
RP/0/RP0/CPU0:router(config)# interface HundredGigE 0/3/0/0
RP/0/RP0/CPU0:router(config-if)# flow mpls monitor MPLS-IPv4-IPv6-fmm sampler fsm ingress
Note |
Flow records are exported using the Version 9 format. |
This example shows how to configure an IPv4 flow record for destination-based NetFlow accounting:
RP/0/RP0/CPU0:router# configure
RP/0/RP0/CPU0:router(config)# flow exporter-map fem
RP/0/RP0/CPU0:router(config-fem)# source Loopback0
RP/0/RP0/CPU0:router(config-fem)# destination 80.80.80.5
RP/0/RP0/CPU0:router(config-fem)# transport udp 1025
RP/0/RP0/CPU0:router(config-fem)# exit
RP/0/RP0/CPU0:router(config)# flow monitor-map map1
RP/0/RP0/CPU0:router(config-fmm)# record ipv4 destination
RP/0/RP0/CPU0:router(config-fmm)# exporter fem
RP/0/RP0/CPU0:router(config-fmm)# exit
RP/0/RP0/CPU0:router(config)# interface pos 0/1/0/0
RP/0/RP0/CPU0:router(config-if)# flow ipv4 monitor map1 ingress
RP/0/RP0/CPU0:router(config-if)# end
RP/0/RP0/CPU0:router# show flow monitor-map map1
The following table lists supported drop codes on NetFlow, when a node is unable to forward the packets due to various reasons listed here. In such cases, the following drop codes are exported instead of output interface index.
|
Drop Reason(s) |
IPFIX/V9 Code |
|---|---|
|
Unknown |
128 |
|
ACL Deny |
129 |
|
Adjacency |
132 |
|
Bad Header Checksum |
134 |
|
Bad TTL |
137 |
These sections provide references related to interface configuration.
|
Related Topic |
Document Title |
|---|---|
|
Cisco IOS XR interface configuration commands |
Interface and Hardware Component Command Reference for the Cisco NCS 6000 Series Routers |
|
Initial system bootup and configuration information for a router using the Cisco IOS XR software. |
|
|
Information about user groups and task IDs |
Interface and Hardware Component Command Reference for the Cisco NCS 6000 Series Routers |
|
Information about configuring interfaces and other components from a remote Craft Works Interface (CWI) client management application. |
Cisco Craft Works Interface User Guide |
|
Standards |
Title |
|---|---|
|
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. |
— |
|
MIBs |
MIBs Link |
|---|---|
| — |
Text for MIBs: To locate and download MIBs using Cisco IOS XR software, use the MIB Locator found at the Cisco Feature Navigator. |
|
RFCs |
Title |
|---|---|
|
3954 |
NetFlow services export protocol Version 9. |
|
7011 |
IPFIX protocol |
|
Description |
Link |
|---|---|
|
The Cisco Technical Support website contains thousands of pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content. |
Feedback