NetFlow Configuration on Cisco Router
Table of Contents
Jump to section:
- • What is NetFlow?
- • Top Talkers configuration (method 1)
- • Top Talkers configuration (method 2)
- • Flow Monitor configuration
- • Flow Monitor with Flow Record configuration
- • Flow Monitor with Flow Sampler configuration
- • Flow Exporter configuration using NetFlow v5
- • Flow Exporter configuration using NetFlow v9
- • Download section
- What is NetFlow? ‹
- Top Talkers configuration (method 1) ‹
- Top Talkers configuration (method 2) ‹
- Flow Monitor configuration ‹
- Flow Monitor with Flow Record configuration ‹
- Flow Monitor with Flow Sampler configuration ‹
- Flow Exporter configuration using NetFlow v5 ‹
- Flow Exporter configuration using NetFlow v9 ‹
- Download section ‹
What is NetFlow?
NetFlow is a network monitoring and analysis tool which is used to capture traffic flows. The captured data flows can be stored in local cache, or exported to a management station where dedicated software can interpret the received NetFlow data and provide a graphical representation.
Locally stored flows can be viewed on a router. A variety of show commands allow to sort and filter NetFlow outputs in the CLI. NetFlow is a powerful tool to perform traffic analysis for baselining and designing networks, for IP accounting, and also for security operations.
Top Talkers configuration (method 1)
In the first example top talker configuration the command ip flow ingress is issued under the interface Gi0/0 to monitor ingress traffic flows on R1. This starts the flow capture on R1 which can be viewed, filtered, and sorted with a show command.
Configuration:
R1
R1#show run int Gi0/0 | sec int
interface GigabitEthernet0/0
description ** to Hosts **
ip address 192.168.1.4 255.255.255.0
ip flow ingress
duplex auto
speed auto
media-type rj45
R1#show ip flow top-talker 2 aggregate source-address sorted-by bytes descending
There are 2 top talkers:
IPV4 SRC ADDR bytes pkts flows
=============== ========== ========== ==========
192.168.1.2 1599368 1072 1
192.168.1.3 864276 580 1
3 of 3 flows matched.
The above NetFlow output shows the two top talkers based on the source IP address, and the device sending the most bytes is displayed at the top of the table. Thus, currently Host2 and Host3 are the two top talkers. When the traffic between the Hosts and the Server stops the NetFlow cache is immediately cleared. By default, the NetFlow cache is not activeted unless the command ip flow ingress is issued.
R1#show ip flow top-talker 2 aggregate source-address sorted-by bytes descending % Cache is not enabled R1#
Top Talkers configuration (method 2)
In the following example, details of the NetFlow top talker cache are separately defined under the command ip flow-top-talkers. This allows for the configuration of a cache-timeout value and defining the show command output parameters. As a result, a simple show command can be used to display information about the top talkers. The information is saved for 60 seconds.
Configuration:
R1
R1#show run int Gi0/0 | sec int interface GigabitEthernet0/0 description ** to Hosts ** ip address 192.168.1.4 255.255.255.0 ip flow ingress duplex auto speed auto media-type rj45 R1#show run | sec ^ip flow ip flow-top-talkers top 2 sort-by bytes cache-timeout 60000 match input-interface GigabitEthernet0/0
R1#show ip flow top-talkers
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Bytes
Gi0/0 192.168.1.1 Gi0/1 10.0.0.1 06 E3C4 0BB8 2368K
Gi0/0 192.168.1.2 Gi0/1 10.0.0.1 06 C690 0BB8 1249K
2 of 2 top talkers shown. 4 of 4 flows matched.
Flow Monitor configuration
In the following scenario a NetFlow monitor is configured to record specific flow data in a defined cache. The NetFlow monitor is applied on the interface Gi0/0 of R1 to capture input flows. The NetFlow cache can be viewed with a show command and represented in a table format.
Configuration:
R1
R1#show run int Gi0/0 | sec int interface GigabitEthernet0/0 description ** to Hosts ** ip address 192.168.1.4 255.255.255.0 ip flow monitor NETFLOW-MONITOR input duplex auto speed auto media-type rj45 R1#show run | sec ^flow flow monitor NETFLOW-MONITOR cache timeout inactive 60 cache timeout active 60 record netflow-original
R1#show flow monitor NETFLOW-MONITOR cache format table
Cache type: Normal
Cache size: 4096
Current entries: 4
High Watermark: 4
Flows added: 5
Flows aged: 1
- Active timeout ( 60 secs) 1
- Inactive timeout ( 60 secs) 0
- Event aged 0
- Watermark aged 0
- Emergency aged 0
IPV4 SRC ADDR IPV4 DST ADDR TRNS SRC PORT TRNS DST PORT INTF INPUT FLOW SAMPLER ID IP TOS IP PROT ip src as ip dst as ipv4 next hop addr ipv4 src mask ipv4 dst mask tcp flags intf output bytes pkts time first time last
=============== =============== ============= ============= ==================== =============== ====== ======= ========= ========= ================== ============= ============= ========= ==================== ========== ========== ============ ============
0.0.0.0 255.255.255.255 68 67 Gi0/0 0 0x00 17 0 0 0.0.0.0 /0 /0 0x00 Null 6232 19 12:40:26.928 12:41:04.198
192.168.1.1 10.0.0.1 58310 3000 Gi0/0 0 0x00 6 0 0 10.0.0.1 /24 /24 0x1A Gi0/1 2133276 1426 12:40:57.300 12:41:05.668
192.168.1.2 10.0.0.1 50834 3000 Gi0/0 0 0x00 6 0 0 10.0.0.1 /24 /24 0x1A Gi0/1 792276 532 12:40:59.195 12:41:05.649
192.168.1.3 10.0.0.1 42064 3000 Gi0/0 0 0x00 6 0 0 10.0.0.1 /24 /24 0x1A Gi0/1 538776 363 12:41:01.169 12:41:05.583
The gathered NetFlow information can be filtered and sorted using various options under the show command. For example, the following output shows the top two devices that transmit the most bytes.
R1#show flow monitor NETFLOW-MONITOR cache sort counter bytes top 2 format table | begin IPV4
IPV4 SRC ADDR IPV4 DST ADDR TRNS SRC PORT TRNS DST PORT INTF INPUT FLOW SAMPLER ID IP TOS IP PROT ip src as ip dst as ipv4 next hop addr ipv4 src mask ipv4 dst mask tcp flags intf output bytes pkts time first time last
=============== =============== ============= ============= ==================== =============== ====== ======= ========= ========= ================== ============= ============= ========= ==================== ========== ========== ============ ============
192.168.1.1 10.0.0.1 58314 3000 Gi0/0 0 0x00 6 0 0 10.0.0.1 /24 /24 0x1E Gi0/1 2238328 1497 12:52:13.519 12:52:24.828
192.168.1.2 10.0.0.1 50838 3000 Gi0/0 0 0x00 6 0 0 10.0.0.1 /24 /24 0x1E Gi0/1 1944368 1302 12:52:16.197 12:52:26.875
The NetFlow cache on R1 can be cleared at any time with the command clear flow monitor NETFLOW-MONITOR cache in exec mode. This can be useful to create a baseline of measurement when there is a continuous stream of ongoing traffic.
Flow Monitor with Flow Record configuration
In the following topology a NetFlow monitor is configured together with a flow record. With a flow record it is possible to define exactly the type and detail of flows captured in the NetFlow cache. The flow record specifies key fields with match statements, and non-key fields with collect statements.
For every key field a seperate flow is created, which means a new line in the NetFlow cache table. Non-key fields do not create separate flows. In the NetFlow show command output, key fields are marked with column headers in all capital letters.
Configuration:
R1
R1#show run int Gi0/0 | sec int interface GigabitEthernet0/0 description ** to Hosts ** ip address 192.168.1.4 255.255.255.0 ip flow monitor NETFLOW-MONITOR input duplex auto speed auto media-type rj45 R1#show run | sec ^flow monitor flow monitor NETFLOW-MONITOR cache timeout inactive 60 cache timeout active 60 record NETFLOW-RECORD R1#show run | sec ^flow record flow record NETFLOW-RECORD match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface input collect counter bytes
R1#show flow monitor NETFLOW-MONITOR cache format table | begin IPV4 IPV4 SRC ADDR IPV4 DST ADDR TRNS SRC PORT TRNS DST PORT INTF INPUT bytes « Key fields in all capital letters =============== =============== ============= ============= ==================== ========== 0.0.0.0 255.255.255.255 68 67 Gi0/0 4920 192.168.1.1 10.0.0.1 58318 3000 Gi0/0 2572776 192.168.1.2 10.0.0.1 50842 3000 Gi0/0 1086276 192.168.1.3 10.0.0.1 42072 3000 Gi0/0 703724 R1#show flow monitor Flow Monitor NETFLOW-MONITOR: Description: User defined « Manually created flow monitor Flow Record: NETFLOW-RECORD Cache: Type: normal Status: allocated Size: 4096 entries / 229392 bytes Inactive Timeout: 60 secs Active Timeout: 60 secs R1#show flow record NETFLOW-RECORD flow record NETFLOW-RECORD: Description: User defined « Manually created flow record with key and non-key fields No. of users: 1 Total field space: 20 bytes Fields: match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface input collect counter bytes
Flow Monitor with Flow Sampler configuration
In the following example scenario, a NetFlow monitor is configured with a custom flow record. Additionally, a sampler is created and attached to the NetFlow monitor under the interface Gi0/0 on R1. As a result, one packet is captured in the NetFlow cache for every 100 ingress packets logged on that interface. This reduces the load on R1's CPU.
Configuration:
R1
R1#show run int Gi0/0 | sec int interface GigabitEthernet0/0 description ** to Hosts ** ip address 192.168.1.4 255.255.255.0 ip flow monitor NETFLOW-MONITOR sampler NETFLOW-SAMPLER input duplex auto speed auto media-type rj45 R1#show run | sec ^flow monitora flow monitor NETFLOW-MONITOR cache timeout inactive 60 cache timeout active 60 record NETFLOW-RECORD R1#show run | sec ^flow record flow record NETFLOW-RECORD match ipv4 source address match ipv4 destination address match transport destination-port match interface input collect counter bytes collect counter packets R1#show run | sec ^sampler sampler NETFLOW-SAMPLER mode deterministic 1 out-of 10
R1#show flow monitor NETFLOW-MONITOR cache format table | beg IPV4 IPV4 SRC ADDR IPV4 DST ADDR TRNS DST PORT INTF INPUT bytes pkts =============== =============== ============= ==================== ========== ========== 0.0.0.0 255.255.255.255 67 Gi0/0 656 2 192.168.1.1 10.0.0.1 3000 Gi0/0 406500 271 192.168.1.2 10.0.0.1 3000 Gi0/0 414092 278 192.168.1.3 10.0.0.1 3000 Gi0/0 444112 297 R1#show sampler Sampler NETFLOW-SAMPLER: Export ID: 2 Description: User defined Type: deterministic Rate: 1 out of 10 Samples: 2728 Requests: 27285 Users (1): flow monitor NETFLOW-MONITOR (ip,Gi0/0,Input) 2728 out of 27285
The above output shows flow information gathered with the sampler configured. To illustrate the benefit of a sampler, the following output shows the same amount of data transfered and gathered without the use of a sampler. As visible, about 10 times as many packets are now captured.
R1#show flow monitor NETFLOW-MONITOR cache format table | beg IPV4
IPV4 SRC ADDR IPV4 DST ADDR TRNS DST PORT INTF INPUT bytes pkts
=============== =============== ============= ==================== ========== ==========
0.0.0.0 255.255.255.255 67 Gi0/0 8856 27
192.168.1.1 10.0.0.1 3000 Gi0/0 3993368 2668
192.168.1.2 10.0.0.1 3000 Gi0/0 4360868 2913
192.168.1.3 10.0.0.1 3000 Gi0/0 4323368 2888
Flow Exporter configuration using NetFlow v5
In the following scenario R1 gathers NetFlow information about ingress traffic on interface Gi0/0. The information collected in the NetFlow cache is exported with a NetFlow Version 5 Exporter. The flow records are exported to the Flow Collector at the IP address 10.0.0.2. The Flow Collector verifies with TCPDUMP that the exported flows are indeed received on UDP port 5000.
Configuration:
R1
R1#show run int Gi0/0 | sec int interface GigabitEthernet0/0 description ** to Hosts ** ip address 192.168.1.4 255.255.255.0 ip flow monitor NETFLOW-MONITOR input duplex auto speed auto media-type rj45 R1#show run int Gi0/1 | sec int interface GigabitEthernet0/1 description ** to Servers ** ip address 10.0.0.3 255.255.255.0 duplex auto speed auto media-type rj45 R1#show run | sec flow exporter flow exporter NETFLOW-EXPORTER destination 10.0.0.2 source GigabitEthernet0/1 transport udp 2055 export-protocol netflow-v5 R1#show run | sec ^flow monitor flow monitor NETFLOW-MONITOR exporter NETFLOW-EXPORTER cache timeout inactive 60 cache timeout active 60 record netflow-original
FlowCollector:~$ sudo tcpdump --interface eth0 udp port 2055 -t -c 5 tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes IP 10.0.0.3.63743 > 10.0.0.2.2055: UDP, length 72 « Exported Flow Records are received on the Flow Collector IP 10.0.0.3.63743 > 10.0.0.2.2055: UDP, length 72 IP 10.0.0.3.63743 > 10.0.0.2.2055: UDP, length 72 IP 10.0.0.3.63743 > 10.0.0.2.2055: UDP, length 72 IP 10.0.0.3.63743 > 10.0.0.2.2055: UDP, length 72 5 packets captured 5 packets received by filter 0 packets dropped by kernel R1#show flow monitor NETFLOW-MONITOR cache format table | begin IPV4 IPV4 SRC ADDR IPV4 DST ADDR TRNS SRC PORT TRNS DST PORT INTF INPUT FLOW SAMPLER ID IP TOS IP PROT ip src as ip dst as ipv4 next hop addr ipv4 src mask ipv4 dst mask tcp flags intf output bytes pkts time first time last =============== =============== ============= ============= ==================== =============== ====== ======= ========= ========= ================== ============= ============= ========= ==================== ========== ========== ============ ============ 0.0.0.0 255.255.255.255 68 67 Gi0/0 0 0x00 17 0 0 0.0.0.0 /0 /0 0x00 Null 5904 18 15:07:01.937 15:07:42.593 192.168.1.1 10.0.0.1 58358 3000 Gi0/0 0 0x00 6 0 0 10.0.0.1 /24 /24 0x1E Gi0/1 2538368 1698 15:07:19.436 15:07:30.201 192.168.1.2 10.0.0.1 50866 3000 Gi0/0 0 0x00 6 0 0 10.0.0.1 /24 /24 0x1E Gi0/1 1401368 940 15:07:22.306 15:07:32.702 192.168.1.3 10.0.0.1 42094 3000 Gi0/0 0 0x00 6 0 0 10.0.0.1 /24 /24 0x1E Gi0/1 2083868 1395 15:07:25.016 15:07:35.590 R1#show flow exporter Flow Exporter NETFLOW-EXPORTER: Description: User defined Export protocol: NetFlow Version 5 Transport Configuration: Destination IP address: 10.0.0.2 Source IP address: 10.0.0.3 Source Interface: GigabitEthernet0/1 Transport Protocol: UDP Destination Port: 2055 Source Port: 63743 DSCP: 0x0 TTL: 255 Output Features: Not Used
The following packet capture shows an example Flow Record being transmitted from R1 to the Flow Collector. As visible, the payload contains data about a specific flow, with the source and destination fields indicating that Host1 (192.168.1.1) reached the Server. Dedicated software on the Flow Collector can display the received Flow Record data graphically using charts or other visuals.
Flow Exporter configuration using NetFlow v9
In the following scenario a NetFlow v9 Exporter is created on R1 using the command export-protocol netflow-v9 under the flow exporter configuration. This is also the default Flexible NetFlow Exporter version used. The benefit of the v9 is that a custom flow record can be attached to a flow monitor and exported. With the Flow Exporter v5 only a default flow record template could be used.
Configuration:
R1
R1#show run int Gi0/0 | sec int interface GigabitEthernet0/0 description ** to Hosts ** ip address 192.168.1.4 255.255.255.0 ip flow monitor NETFLOW-MONITOR input duplex auto speed auto media-type rj45 R1#show run | sec ^flow monitor flow monitor NETFLOW-MONITOR exporter NETFLOW-EXPORTER cache timeout inactive 60 cache timeout active 60 record NETFLOW-RECORD R1#show run | sec ^flow record flow record NETFLOW-RECORD match ipv4 source address match ipv4 destination address match transport destination-port collect counter packets R1#show run | sec ^flow exporter flow exporter NETFLOW-EXPORTER destination 10.0.0.2 source GigabitEthernet0/1 transport udp 2055
FlowCollector:~$ sudo tcpdump --interface eth0 udp port 2055 -t -c 5
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
IP 10.0.0.3.63743 > 10.0.0.2.2055: UDP, length 68
IP 10.0.0.3.63743 > 10.0.0.2.2055: UDP, length 68
IP 10.0.0.3.63743 > 10.0.0.2.2055: UDP, length 68
IP 10.0.0.3.63743 > 10.0.0.2.2055: UDP, length 40
IP 10.0.0.3.63743 > 10.0.0.2.2055: UDP, length 68
5 packets captured
5 packets received by filter
0 packets dropped by kernel
As visible in the above TCPDUMP output from the Flow Collector, the packet sizes of Exporter v9 are smaller than v5. The content of a v9 exported flow is shown in the following packet capture. As visible, a custom flow record is exported, and not the default template.
