Configuring NetFlow and NetFlow Data Export

NetFlow exports data in UDP datagrams in one of the following formats: Version 9, Version 8, Version 7, Version 5, or Version 1:

• Version 9--A flexible and extensible format, which provides the versatility needed for support of new fields and record types. This format accommodates new NetFlow-supported technologies such as Multicast, MPLS, and Border Gateway Protocol (BGP) next hop. The Version 9 export format enables you to use the same version for main and aggregation caches, and the format is extensible, so you can use the same export format with future features.
• Version 8--A format added to support data export from aggregation caches. Export datagrams contain a subset of the usual Version 5 export data, which is valid for the particular aggregation cache scheme.
• Version 5--A later enhanced version that adds BGP-AS information and flow sequence numbers. (Versions 2 through 4 were not released.) This is the most commonly used format.
• Version 1--The initially released export format that is rarely used today. Do not use the Version 1 export format unless the legacy collection system that you are using requires it. Use either the Version 9 export format or the Version 5 export format.

The following sections provide more detailed information on NetFlow Data Export Formats:

For all export versions, the NetFlow export datagram consists of a header and a sequence of flow records. The header contains information such as sequence number, record count, and system uptime. The flow record contains flow information such as IP addresses, ports, and routing information.

The NetFlow Version 9 export format is the newest NetFlow export format. The distinguishing feature of the NetFlow Version 9 export format is that it is template based. Templates make the record format extensible. This feature allows future enhancements to NetFlow without requiring concurrent changes to the basic flow-record format.

The use of templates with the NetFlow Version 9 export format provides several other key benefits:

• You can export almost any information from a router or switch, including Layer 2 through 7 information, routing information, and IP Version 6 (IPv6), IP Version 4 (IPv4), Multicast, and MPLS information. This new information allows new applications of export data and provides new views of network behavior.
• Third-party business partners who produce applications that provide collector or display services for NetFlow are not required to recompile their applications each time a new NetFlow export field is added. Instead, they might be able to use an external data file that documents the known template formats.
• New features can be added to NetFlow more quickly, without breaking current implementations.
• Netflow is "future proofed" because the Version 9 export format can be adapted to provide support for new and developing protocols and other non-NetFlow-based approaches to data collection.

The work of the IETF IP, Information Export (IPFIX) Working Group (WG), and the IETF Pack Sampling (PSAMP) WG are based on the NetFlow Version 9 export format.

The Version 1 export format was the original format supported in the initial Cisco IOS software releases containing the NetFlow functionality; it is rarely used today. The Version 5 export format is an enhancement that adds BGP autonomous system information and flow sequence numbers. Versions 2 through 4 and Version 6 export formats were either not released or not supported. The Version 8 export format is the NetFlow export format to use when you enable router-based NetFlow aggregation on Cisco IOS router platforms.

The figure below shows a typical datagram used for NetFlow fixed format export Versions 1, 5, 7, and 8.

In all the five export versions, the datagram consists of a header and one or more flow records. The first field of the header contains the version number of the export datagram. Typically, a receiving application that accepts any of the format versions allocates a buffer large enough for the largest possible datagram from any of the format versions and then uses the header to determine how to interpret the datagram. The second field in the header contains the number of records in the datagram (indicating the number of expired flows represented by this datagram). Datagram headers for NetFlow Export Versions 5, 8, and 9 also include a "sequence number" field used by NetFlow collectors to check for lost datagrams.

The NetFlow Version 9 export packet header format is shown in the figure below.

The table below lists the NetFlow Version 9 export packet header field names and descriptions.

This section gives details about the Cisco export format flow record. The table below indicates which flow record format fields are available for Versions 5 and 9. ('Yes' indicates that the field is available. 'No' indicates that the field is not available.)

The figure below is an example of the NetFlow Version 5 export record format, including the contents and description of byte locations. The terms in bold indicate values that were added for the Version 5 format.

The table below shows the field names and descriptions for the NetFlow Version 5 export record format.

The figure below shows a typical flow record for the Version 9 export format. The NetFlow Version 9 export record format is different from the traditional NetFlow fixed format export record. In NetFlow Version 9, a template describes the NetFlow data and the flow set contains the actual data. This allows for flexible export. Detailed information about the fields in Version 9 and export format architecture is available in the NetFlow Version 9 Flow-Record Format document.

For all export versions, you can specify a destination where NetFlow data export packets are sent, such as the workstation running NetFlow Collection Engine, when the number of recently expired flows reaches a predetermined maximum, or every second--whichever occurs first. For a Version 1 datagram, up to 24 flows can be sent in a single UDP datagram of approximately 1200 bytes; for a Version 5 datagram, up to 30 flows can be sent in a single UDP datagram of approximately 1500 bytes.

For detailed information on the flow record formats, data types, and export data fields for Versions 1, 7, and 9 and platform-specific information when applicable, see Appendix 2 in the NetFlow Services Solutions Guide .

NetFlow exports data in UDP datagrams in export format Version 9, 8, 5, or 1. The table below describes situations when you might select a particular NetFlow export format.

The NetFlow Version 9 Export Format feature was introduced in Cisco IOS Release 12.0(24)S and was integrated into Cisco IOS Release 12.3(1) and Cisco IOS Release 12.2(18)S.

NetFlow Version 9 data export supports Cisco Express Forwarding switching, distributed Cisco Express Forwarding switching, and fast switching.

NetFlow Version 9 is a flexible and extensible means for transferring NetFlow records from a network node to a collector. NetFlow Version 9 has definable record types and is self-describing for easier NetFlow Collection Engine configuration.

Using Version 9 export, you can define new formats on the router and send these formats to the NetFlow Collection Engine (formerly called NetFlow FlowCollector) at set intervals. You can enable the features that you want, and the field values corresponding to those features are sent to the NetFlow Collection Engine.

Third-party business partners who produce applications that provide NetFlow Collection Engine or display services for NetFlow need not recompile their applications each time a new NetFlow technology is added. Instead, with the NetFlow Version 9 Export Format feature, they can use an external data file that documents the known template formats and field types.

In NetFlow Version 9

• Record formats are defined by templates.
• Template descriptions are communicated from the router to the NetFlow Collection Engine.
• Flow records are sent from the router to the NetFlow Collection Engine with minimal template information so that the NetFlow Collection Engine can relate the records to the appropriate template.
• Version 9 is independent of the underlying transport protocol (UDP, TCP, SCTP, and so on).

The Version 8 data export format is the NetFlow export format used when the router-based NetFlow Aggregation feature is enabled on Cisco IOS router platforms. The Version 8 format allows for export datagrams to contain a subset of the Version 5 export data that is based on the configured aggregation cache scheme. For example, a certain subset of the Version 5 export data is exported for the destination prefix aggregation scheme, and a different subset is exported for the source-prefix aggregation scheme.

The Version 8 export format was introduced in Cisco IOS Release 12.0(3)T for the Cisco IOS NetFlow Aggregation feature. An additional six aggregation schemes that also use Version 8 format were defined for the NetFlow ToS-Based Router Aggregation feature introduced in Cisco IOS 12.0(15)S and integrated into Cisco IOS Releases 12.2(4)T and 12.2(14)S. Refer to the "Configuring NetFlow Aggregation Caches" module for information on configuring Version 8 data export for aggregation caches.

The Version 8 datagram consists of a header with the version number (which is 8) and time-stamp information, followed by one or more records corresponding to individual entries in the NetFlow cache.

The figure below displays the NetFlow Version 8 export packet header format.

The table below lists the NetFlow Version 8 export packet header field names and definitions.

The Version 5 data export format adds support for BGP autonomous system information and flow sequence numbers.

Because NetFlow uses UDP to send export datagrams, datagrams can be lost. The Version 5 header format contains a flow sequence number to find out whether flow export information has been lost. The sequence number is equal to the sequence number of the previous datagram plus the number of flows in the previous datagram. After receiving a new datagram, the receiving application can subtract the expected sequence number from the sequence number in the header to get the number of missed flows.

All fields in the Version 5 export format are in network byte order. The figure below shows the NetFlow Version 5 export packet header format.

The table below lists the NetFlow Version 5 export packet header field names and descriptions.

The NetFlow Version 1 data export format was the format supported in the initial Cisco IOS software releases containing the NetFlow functionality. It is rarely used today. Do not use the Version 1 export format unless the legacy collection system you are using requires it. Use either the Version 9 export format or the Version 5 export format.

The figure below shows the NetFlow Version 1 export packet header format.

The table below lists the NetFlow Version 1 export packet header field names and descriptions.

The routing device checks the NetFlow cache once per second and causes the flow to expire in the following instances:

• Flow transport is completed (TCP connections that have reached the end of the byte stream [FIN] or that have been reset [RST] are expired).
• The flow cache has become full.
• A flow becomes inactive. By default, a flow that is unaltered in the last 15 seconds is classified as inactive.
• An active flow has been monitored for a specified number of minutes. By default, active flows are flushed from the cache when they have been monitored for 30 minutes.

Routing device default timer settings are 15 seconds for the inactive timer and 30 minutes for the active timer. You can configure your own time interval for the inactive timer from 10 to 600 seconds. You can configure the time interval for the active timer from 1 to 60 minutes.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    no ip flow {ingress | egress}

5.    exit

6.    Repeat Steps 3 through 5 for every interface that has NetFlow enabled on it.

7.    ip flow-cache entries number

8.    ip flow-cache timeout active minutes

9.    ip flow-cache timeout inactive seconds

10.    interface type number

11.    ip flow {ingress | egress}

12.    exit

13.    Repeat Steps 10 through 12 for every interface that previously had NetFlow enabled on it.

14.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface type number Example: Router(config)# interface ethernet 0/0	(Required if NetFlow is already enabled on the interface) Specifies the interface that you want to disable NetFlow on and enters interface configuration mode.
Step 4	no ip flow {ingress | egress} Example: Router(config-if)# no ip flow ingress Example:	(Required if NetFlow is enabled on the interface) Disables NetFlow on the interface. ingress --Captures traffic that is being received by the interface egress --Captures traffic that is being transmitted by the interface
Step 5	exit Example: Router(config-if)# exit	(Optional) Exits interface configuration mode and returns to global configuration mode. Note    You only need to use this command if you need to disable NetFlow on another interface.
Step 6	Repeat Steps 3 through 5 for every interface that has NetFlow enabled on it.	This step is required if NetFlow is enabled on any other interfaces. --
Step 7	ip flow-cache entries number Example: Router(config)# ip flow-cache entries 131072	(Optional) Changes the number of entries maintained in the NetFlow cache. The number argument is the number of entries to be maintained. The valid range is from 1024 to 524288 entries. The default is 65536 (64K).
Step 8	ip flow-cache timeout active minutes Example: Router(config)# ip flow-cache timeout active 20	(Optional) Specifies flow cache timeout parameters. The active keyword specifies the active flow timeout. The minutes argument specifies the number of minutes that an active flow remains in the cache before the flow times out. The range is from 1 to 60. The default is 30.
Step 9	ip flow-cache timeout inactive seconds Example: Router(config)# ip flow-cache timeout inactive 130	(Optional) Specifies flow cache timeout parameters. The inactive keyword specifies the inactive flow timeout. The seconds argument specifies the number of seconds that an inactive flow remains in the cache before it times out. The range is from 10 to 600. The default is 15.
Step 10	interface type number Example: Router(config)# interface ethernet 0/0	Specifies the interface that you want to enable NetFlow on and enters interface configuration mode.
Step 11	ip flow {ingress | egress} Example: Router(config-if)# ip flow ingress Example:	Enables NetFlow on the interface. ingress --Captures traffic that is being received by the interface egress --Captures traffic that is being transmitted by the interface
Step 12	exit Example: Router(config-if)# exit	(Optional) Exits interface configuration mode and returns to global configuration mode. Note    You need to use this command only if you need to enable NetFlow on another interface.
Step 13	Repeat Steps 10 through 12 for every interface that previously had NetFlow enabled on it.	This step is required for any other interfaces that you need to enable NetFlow on.
Step 14	end Example: Router(config-if)# end	Exits the current configuration mode and enters privileged EXEC mode.

configure terminal
!
interface ethernet 0/0.1
 ip flow ingress
!

configure terminal
!
interface ethernet 1/0.1
 ip flow egress
!

Note

NetFlow performs additional checks for the status of each subinterface that requires more CPU processing time and bandwidth. If you have several subinterfaces configured and you want to configure NetFlow data capture on all of them, we recommend that you configure NetFlow on the main interface instead of on the individual subinterfaces.