The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Contents
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
The following are prerequisites for your Flexible NetFlow configuration:
The following are the prerequisites for wireless Flexible NetFlow:
The following are restrictions for Flexible NetFlow:
Traditional NetFlow (TNF) accounting is not supported.
Flexible NetFlow v5 export format is not supported, only NetFlow v9 export format is supported.
Both ingress and egress NetFlow accounting is supported.
Microflow policing feature shares the NetFlow hardware resource with FNF.
Only one flow monitor per interface and per direction is supported.
Layer 2, IPv4, and IPv6 traffic types are supported; however, the switch can apply a flow monitor to only one of these types at a time for a given direction and interface.
Layer 2, VLAN, and Layer 3 interfaces are supported, but the switch does not support SVI and tunnels.
The following NetFlow table sizes are supported:
Trim Level |
Ingress NetFlow Table |
Egress NetFlow Table |
---|---|---|
LAN Base |
Not supported |
Not supported |
IP Base |
8 K |
16 K |
IP Services |
8 K |
16 K |
Depending on the switch type, a switch will have one or two forwarding ASICs. The capacities listed in the above table are on a per-ASIC basis.
The NetFlow tables are on separate compartments and cannot be combined. Depending on which ASIC processed the packet, the flows will be created in the table in the corresponding ASIC.
Both full flow accounting and sampled NetFlow accounting are supported.
NetFlow hardware implementation supports four hardware samplers. You can select a sampler rate from 1 out of 2 to 1 out of 1024. Only random sampling mode is supported.
With the microflow policing feature (which is enabled only for wireless implementation), NetFlow can and should be used only in full flow mode i.e. NetFlow policing cannot be used. For wireless traffic, applying a sampler is not permitted, as it hinders microflow QoS.
Only full flow accounting is supported for wireless traffic.
NetFlow hardware uses hash tables internally. Hash collisions can occur in the hardware. Therefore, in spite of the internal overflow Content Addressable Memory (CAM), the actual NetFlow table utilization could be about 80 percent.
Depending on what fields are used for the flow, a single flow could take two consecutive entries. IPv6 flows also take two entries. In these situations, the effective usage of NetFlow entries is half the table size, which is separate from the above hash collision limitation.
The switch supports up to 16 flow monitors.
Microflow policing uses a separate set of flow monitors (limit 3).
SSID-based NetFlow accounting is supported. SSID is treated in a manner similar to an interface. However, certain fields are not supported (such as AP MAC address and user ID ).
NetFlow v9 format NetFlow export is supported.
The NetFlow software implementation supports distributed NetFlow export, so the flows are exported from the same switch in which the flow was created.
Ingress flows are present in the ASIC that first received the packets for the flow. Egress flows are present in the ASIC from which the packets actually left the switch set up.
The reported value for the bytes count field (called “bytes long”) is Layer-2-packet-size—18 bytes. For classic Ethernet traffic (802.3), this will be accurate. For all other Ethernet types, this field will not be accurate. Use the "bytes layer2” field, which always reports the accurate Layer 2 packet size. For information about supported Flexible NetFlow fields, see Supported Flexible NetFlow Fields.
NetFlow is a Cisco technology that provides statistics on packets flowing through the switch. NetFlow is the standard for acquiring IP operational data from IP networks. NetFlow provides data to enable network and security monitoring, network planning, traffic analysis, and IP accounting. Flexible NetFlow improves on original NetFlow by adding the capability to customize the traffic analysis parameters for your specific requirements. Flexible NetFlow facilitates the creation of more complex configurations for traffic analysis and data export through the use of reusable configuration components.
Flexible NetFlow uses flows to provide statistics for accounting, network monitoring, and network planning.
A flow is a unidirectional stream of packets that arrives on a source interface and has the same values for the keys. A key is an identified value for a field within the packet. You create a flow using a flow record to define the unique keys for your flow.
The switch supports the Flexible NetFlow feature that enables enhanced network anomalies and security detection. Flexible NetFlow allows you to define an optimal flow record for a particular application by selecting the keys from a large collection of predefined fields.
All key values must match for the packet to count in a given flow. A flow might gather other fields of interest, depending on the export record version that you configure. Flows are stored in the Flexible NetFlow cache.
You can export the data that Flexible NetFlow gathers for your flow by using an exporter and export this data to a remote Flexible NetFlow collector.
You define the size of the data that you want to collect for a flow using a monitor. The monitor combines the flow record and exporter with the Flexible NetFlow cache information.
The wireless Flexible NetFlow infrastructure supports the following:
Microflow Policing and User-Based Rate Limiting
Microflow policing associates a 2-color 1-rate policer and related drop statistics to each flow present in the NetFlow table. When the flow mask comprises all packet fields, this functionality is known as microflow policing. When the flow mask comprises either source or destination only, this functionality is known as user-based rate limiting.
Voice and Video Flow Monitoring
Voice and video flows are full flow mask-based entries. The ASIC provides the flexibility to program the policer parameters, share policers across multiple flows and rewrite the IP address and Layer 4 port numbers of these flows.
Note | For dynamic entries, the NetFlow engine will use the policer parameters that are derived for the flow based on the policy (ACL/QoS-based policies). Dynamic entries cannot share policer across multiple flows. |
Reflexive ACL
Reflexive ACLs allow IP packets to be filtered based on upper-layer session information. The ACLs allow outbound traffic and limit inbound traffic in response to the sessions that originate inside the trusted network. The reflexive ACLs are transparent to the filtering mechanism until a data packet that matches the reflexive entry activates it. At this time, a temporary ACL entry is created and added to the IP-named access lists. The information obtained from the data packet to generate the reflexive ACL entry is permit/deny bit, the source IP address and port, the destination IP address, port, and the protocol type. During reflexive ACL entry evaluation, if the protocol type is either TCP or UDP, then the port information must match exactly. For other protocols, there is no port information to match. After this ACL is installed, the firewall is then opened for the reply packets to pass through. At this time, a potential hacker could have access to the network behind the firewall. To narrow this window, an idle timeout period can be defined. However, in the case of TCP, if two FIN bits or an RST is detected, the ACL entry can be removed.
A flow record defines the keys that Flexible NetFlow uses to identify packets in the flow, as well as other fields of interest that Flexible NetFlow gathers for the flow. You can define a flow record with any combination of keys and fields of interest. The switch supports a rich set of keys. A flow record also defines the types of counters gathered per flow. You can configure 64-bit packet or byte counters. The switch enables the following match fields as the defaults when you create a flow record:
The following table describes Flexible NetFlow match parameters. You must configure at least one of the following match parameters for the flow records.
The following table describes the Flexible NetFlow collect parameters.
Command |
Purpose |
||
---|---|---|---|
collect counter { bytes { layer2 { long } | long } | packets { long } } |
Collects the counter fields total bytes and total packets. |
||
collect interface {input | output} |
Collects the fields from the input or output interface. |
||
collect timestamp absolute {first | last} |
Collects the fields for the absolute time the first packet was seen or the absolute time the most recent packet was last seen (in milliseconds). |
||
collect transport tcp flags |
|
An exporter contains network layer and transport layer details for the Flexible NetFlow export packet. The following table lists the configuration options for an exporter.
Exporter Configuration |
Description |
---|---|
default |
Sets a command to its default values. |
description |
Provides a description for the flow exporter. |
destination |
Export destination. |
dscp |
Optional DSCP value. |
exit |
Exits from the flow exporter configuration mode. |
export-protocol |
Export protocol version. |
no |
Negates the command or its default. |
option |
Selects option for exporting. |
source |
Originating interface for the net flow. |
template |
Flow exporter template configuration. |
transport |
Transport protocol. |
ttl |
Optional TTL or hop limit. |
The switch exports data to the collector whenever a timeout occurs or when the flow is terminated (TCP Fin or Rst received, for example). You can configure the following timers to force a flow export:
The switch supports only NetFlow Version 9 export formats. NetFlow Version 9 export format provides the following features and functionality:
Variable field specification format
Support for IPv6, Layer 2, and MPLS fields
More efficient network utilization
Note | For information about the Version 9 export format, see RFC 3954. |
A monitor references the flow record and flow exporter. You apply a monitor to an interface on the switch.
Note the following when applying a flow monitor to an interface:
If you are using sampled mode, you use the sampler to specify the rate at which packets are sampled.
Note | If the packet has a VLAN field, then that length is not accounted for. |
Field |
Layer 2 In |
Layer 2 Out |
IPv4 In |
IP v4 Out |
IPv6 In |
IPv6 Out |
Notes |
---|---|---|---|---|---|---|---|
Key or Collect Fields |
|||||||
Interface input |
Yes |
— |
Yes |
— |
Yes |
— |
If you apply a flow monitor in the input direction: |
Interface output |
— |
Yes |
— |
Yes |
— |
Yes |
If you apply a flow monitor in the output direction: |
Field |
Layer 2 In |
Layer 2 Out |
IPv4 In |
IP v4 Out |
IPv6 In |
IPv6 Out |
Notes |
---|---|---|---|---|---|---|---|
Key Fields |
|||||||
Flow direction |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
|
Ethertype |
Yes |
Yes |
— |
— |
— |
— |
|
VLAN input |
Yes |
— |
Yes |
— |
Yes |
— |
Supported only for a switch port. |
VLAN output |
— |
Yes |
— |
Yes |
— |
Yes |
Supported only for a switch port. |
dot1q VLAN input |
Yes |
— |
Yes |
— |
Yes |
— |
Supported only for a switch port. |
dot1q VLAN output |
— |
Yes |
— |
Yes |
— |
Yes |
Supported only for a switch port. |
dot1q priority |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
Supported only for a switch port. |
MAC source address input |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
|
MAC source address output |
— |
— |
— |
— |
— |
— |
|
MAC destination address input |
Yes |
— |
Yes |
— |
Yes |
— |
|
MAC destination address output |
— |
Yes |
— |
Yes |
— |
Yes |
|
IPv4 version |
— |
— |
Yes |
Yes |
Yes |
Yes |
|
IPv4 TOS |
— |
— |
Yes |
Yes |
Yes |
Yes |
|
IPv4 protocol |
— |
— |
Yes |
Yes |
Yes |
Yes |
Must use if any of src/dest port, ICMP code/type, IGMP type or TCP flags are used. |
IPv4 TTL |
— |
— |
Yes |
Yes |
Yes |
Yes |
|
IPv4 source address |
— |
— |
Yes |
Yes |
— |
— |
|
IPv4 destination address |
— |
— |
Yes |
Yes |
— |
— |
|
ICMP IPv4 type |
— |
— |
Yes |
Yes |
— |
— |
|
ICMP IPv4 code |
— |
— |
Yes |
Yes |
— |
— |
|
IGMP type |
— |
— |
Yes |
Yes |
— |
— |
Field |
Layer 2 In |
Layer 2 Out |
IPv4 In |
IP v4 Out |
IPv6 In |
IPv6 Out |
Notes |
---|---|---|---|---|---|---|---|
Key Fields continued |
|||||||
IPv6 version |
— |
— |
Yes |
Yes |
Yes |
Yes |
Same as IP version. |
IPv6 protocol |
— |
— |
Yes |
Yes |
Yes |
Yes |
Same as IP protocol. Must use if any of src/dest port, ICMP code/type, IGMP type or TCP flags are used. |
IPv6 source address |
— |
— |
— |
— |
Yes |
Yes |
|
IPv6 destination address |
— |
— |
— |
— |
Yes |
Yes |
|
IPv6 traffic-class |
— |
— |
Yes |
Yes |
Yes |
Yes |
Same as IP TOS. |
IPv6 hop-limit |
— |
— |
Yes |
Yes |
Yes |
Yes |
Same as IP TTL. |
ICMP IPv6 type |
— |
— |
— |
— |
Yes |
Yes |
|
ICMP IPv6 code |
— |
— |
— |
— |
Yes |
Yes |
|
source-port |
— |
— |
Yes |
Yes |
Yes |
Yes |
|
dest-port |
— |
— |
Yes |
Yes |
Yes |
Yes |
Field |
Layer 2 In |
Layer 2 Out |
IPv4 In |
IP v4 Out |
IPv6 In |
IPv6 Out |
Notes |
---|---|---|---|---|---|---|---|
Collect Fields |
|||||||
Bytes long |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
Packet size = (Ethernet frame size including FCS - 18 bytes) Recommended: Avoid this field and use Bytes layer2 long. |
Packets long |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
|
Timestamp absolute first |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
|
Timestamp absolute last |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
|
TCP flags |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
Collects all flags. |
Bytes layer2 long |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
The following table lists the Flexible NetFlow default settings for the switch.
Setting |
Default |
---|---|
Flow active timeout |
1800 seconds |
Flow timeout inactive |
Enabled, 15 seconds |
To configure Flexible NetFlow, follow these general steps:
Create a flow record by specifying keys and non-key fields to the flow.
Create an optional flow exporter by specifying the protocol and transport destination port, destination, and other parameters.
Create a flow monitor based on the flow record and flow exporter.
Create a sampler.
Apply the flow monitor to a Layer 2 port, Layer 3 port, or VLAN.
If applicable to your configuration, configure a WLAN to apply a flow monitor to.
You can create a flow record and add keys to match on and fields to collect in the flow.
2.
flow record name
3.
description string
4.
match type
5.
collect type
7.
show flow record [name record-name]
Command or Action | Purpose | |
---|---|---|
Step 1 | configure terminal Example: Switch# configure terminal | |
Step 2 | flow record name Example: Switch(config)# flow record test Switch(config-flow-record)# | Creates a flow record and enters flow record configuration mode. |
Step 3 | description string Example:
Switch(config-flow-record)# description Ipv4Flow
| (Optional) Describes this flow record as a maximum 63-character string. |
Step 4 | match type Example: Switch(config-flow-record)# match ipv4 source address Switch(config-flow-record)# match ipv4 destination address Switch(config-flow-record)# match flow direction | Specifies a match key. For information about possible match key values, see Flexible NetFlow Match Parameters. |
Step 5 | collect type Example: Switch(config-flow-record)# collect counter bytes layer2 long Switch(config-flow-record)# collect counter bytes long Switch(config-flow-record)# collect timestamp absolute first Switch(config-flow-record)# collect transport tcp flags | Specifies the collection field. For information about possible collection field values, see Flexible NetFlow Collect Parameters. |
Step 6 | end Example: Switch(config-flow-record)# end | |
Step 7 | show flow record [name record-name] Example:
Switch show flow record test
| (Optional) Displays information about NetFlow flow records. |
Step 8 | copy running-config startup-config Example: Switch# copy running-config startup-config |
Define an optional flow exporter by specifying the export format, protocol, destination, and other parameters.
You can create a flow export to define the export parameters for a flow.
2.
flow exporter name
3.
description string
4.
dscp value
5.
destination { ipv4-address }
6.
source { source type }
7.
transport udp number
9.
show flow exporter [name record-name]
Define a flow monitor based on the flow record and flow exporter.
You can create a flow monitor and associate it with a flow record and a flow exporter.
2.
flow monitor name
3.
description string
4.
exporter name
5.
record name
6.
cache { timeout {active | inactive} seconds | type normal }
8.
show flow monitor [name record-name]
Apply the flow monitor to a Layer 2 interface, Layer 3 interface, or VLAN.
You can create a sampler to define the NetFlow sampling rate for a flow.
2.
sampler name
3.
description string
4.
mode {random}
6.
show sampler [name]
Apply the flow monitor to a source interface, subinterface, VLAN interface, or a VLAN.
You can apply a flow monitor and an optional sampler to an interface.
Note the following when applying a flow monitor to an interface:
2.
interface type
3.
ip flow monitor name [sampler name] { input |output }
5.
show flow interface [interface-type number]
You can apply a flow monitor and an optional sampler to a VLAN.
2.
vlan [configuration] vlan-id
3.
ip flow monitor name [sampler name] {input |output}
You can define Layer 2 keys in Flexible NetFlow records that you can use to capture flows in Layer 2 interfaces.
2.
flow record name
3.
match datalink {dot1q |ethertype | mac | vlan}
5.
show flow record [name ]
1.
configure terminal
2.
wlan wlan-name
3.
datalink flow monitor monitor-name {input | output}
4.
end
5.
show wlan wlan-name
1.
configure terminal
2.
wlan wlan-id
3.
{ipv4 |ipv6} flow monitor monitor-name {input | output}
4.
end
5.
show wlan wlan-name
Command |
Purpose |
---|---|
show flow exporter [broker | export-ids | name | name | statistics | templates] |
Displays information about NetFlow flow exporters and statistics. |
show flow exporter [ name exporter-name] |
Displays information about NetFlow flow exporters and statistics. |
show flow interface |
Displays information about NetFlow interfaces. |
show flow monitor [ name exporter-name] |
Displays information about NetFlow flow monitors and statistics. |
show flow record [ name record-name] |
Displays information about NetFlow flow records. |
show flow ssid |
Displays NetFlow monitor installation status for a WLAN. |
show sampler [broker | name | name] |
Displays information about NetFlow samplers. |
show wlan wlan-name |
Displays the WLAN configured on the device. |
This example shows how to create a flow and apply it to an interface:
Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# flow export export1 Switch(config-flow-exporter)# destination 10.0.101.254 Switch(config-flow-exporter)# transport udp 2055 Switch(config-flow-exporter)# exit Switch(config)# flow record record1 Switch(config-flow-record)# match ipv4 source address Switch(config-flow-record)# match ipv4 destination address Switch(config-flow-record)# match ipv4 protocol Switch(config-flow-record)# match transport source-port Switch(config-flow-record)# match transport destination-port Switch(config-flow-record)# collect counter byte long Switch(config-flow-record)# collect counter packet long Switch(config-flow-record)# collect timestamp absolute first Switch(config-flow-record)# collect timestamp absolute last Switch(config-flow-record)# exit Switch(config)# flow monitor monitor1 Switch(config-flow-monitor)# record record1 Switch(config-flow-monitor)# exporter export1 Switch(config-flow-monitor)# exit Switch(config)# interface tenGigabitEthernet 1/0/1 Switch(config-if)# ip flow monitor monitor1 input Switch(config-if)# end
The following example shows how to configure IPv4 Flexible NetFlow on WLAN ingress direction:
Switch# configure terminal Switch(config)# flow record fr_v4 Switch(config-flow-record)# match ipv4 destination Switch(config-flow-record)# match ipv4 source Switch(config-flow-record)# match ipv4 protocol Switch(config-flow-record)# match ipv4 tos Switch(config-flow-record)# match ipv4 ttl Switch(config-flow-record)# match ipv4 version Switch(config-flow-record)# collect counter packets long Switch(config-flow-record)# collect counter bytes long Switch(config-flow-record)# collect timestamp sys-uptime first Switch(config-flow-record)# collect timestamp sys-uptime last Switch(config-flow-record)# exit Switch(config)# flow monitor fm_v4 Switch(config-flow-monitor)# record fr_v4 Switch(config-flow-record)# exit Switch(config)# wlan 1 Switch(config-wlan)# ip flow monitor fm_v4 in Switch(config-wlan)# end Switch# show flow monitor fm_v4 cache
The following example shows how to configure IPv6 and transport flag Flexible NetFlow on WLAN egress direction:
Switch# configure terminal Switch(config)# flow record fr_v6 Switch(config-flow-record)# match ipv6 destination Switch(config-flow-record)# match ipv6 source Switch(config-flow-record)# match ipv6 hop-limit Switch(config-flow-record)# match ipv6 protocol Switch(config-flow-record)# match ipv6 traffic class Switch(config-flow-record)# match ipv6 version Switch(config-flow-record)# collect counter bytes long Switch(config-flow-record)# collect transport tcp flags Switch(config-flow-record)# exit Switch(config)# flow monitor fm_v6 Switch(config-flow-monitor)# record fr_v6 Switch(config-flow-monitor)# exit Switch(config)# wlan 1 Switch(config-wlan)# ipv6 flow monitor fm_v6 out Switch(config-wlan)# end Switch# show flow monitor fm_v6 cache
Note | On the switch, you cannot specify which TCP flag to collect. You can only specify to collect transport TCP flags. |
The following example shows how to configure IPv6 Flexible NetFlow on WLAN in both directions:
Switch# configure terminal Switch (config)# flow record fr_v6 Switch (config-flow-record)# match ipv6 destination Switch (config-flow-record)# match ipv6 source Switch (config-flow-record)# match ipv6 hop-limit Switch (config-flow-record)# match ipv6 protocol Switch (config-flow-record)# match ipv6 traffic class Switch (config-flow-record)# match ipv6 version Switch (config-flow-record)# collect counter packets long Switch (config-flow-record)# exit Switch (config)# flow monitor fm_v6 Switch (config-flow-monitor)# record fr_v6 Switch (config-flow-monitor)# exit Switch (config)# wlan 1 Switch (config-wlan)# ipv6 flow monitor fm_v6 in Switch (config-wlan)# ipv6 flow monitor fm_v6 out Switch (config-wlan)# end Switch# show flow monitor fm_v6 cache
Related Topic | Document Title |
---|---|
Flexible NetFlow CLI Commands |
Flexible NetFlow Command Reference Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches) |
Platform-independent configuration information for Flexible NetFlow |
Flexible Netflow Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches) |
Standard/RFC | Title |
---|---|
RFC 3954 |
Cisco Systems NetFlow Services Export Version 9 |
MIB | MIBs Link |
---|---|
All supported MIBs for this release. |
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: |
Description | Link |
---|---|
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. |
Feature Name |
Releases |
Feature Information |
---|---|---|
Flexible NetFlow feature support |
Cisco IOS XE 3.2SE |
Flexible NetFlow uses flows to provide statistics for accounting, network monitoring, and network planning. |