You can match the
following fields for the flow record:
- IPv4 or IPv6 destination
address
- Datalink fields, to identify
Layer 2 source and destination address and VLAN for traffic entering or leaving
the interfaces, providing the MAC address of the directly connected host. Class
of Service (CoS) and Ethertype datalink header fields are also available.
- Transport field source and
destination ports, to identify the type of application: ICMP, IGMP, or TCP
traffic.
You can collect the
following fields for the flow record:
- The total number of bytes,
flows or packets sent by the exporter (exporter) or the number of bytes or
packets in a 64-bit counter (long). The timestamp based on system uptime from
the time the first packet was sent or from the time the most recent (last)
packet was seen.
- The SNMP index of the input
or output interface. The interface for traffic entering or leaving the service
module is based on the switch forwarding cache. This field is typically used in
conjunction with datalink, IPv4, and IPv6 addresses, and provides the actual
first-hop interface for directly connected hosts.
- A value of 0 means that
interface information is not available in the cache.
- Some NetFlow collectors
require this information in the flow record.
The following steps
configure the customized flow record: