Since I posted my last blog “Wanted: Cisco ASA NetFlow packet capture” I have received a few files. Thank you.

It was quite a process as those who were kind enough to send me a WireShark capture with lots of v9 packets quickly learned that the file was useless without the Cisco NetFlow v9 templates.  Templates are sent out as often as 1-30 minutes.  Guess what the default rate is. 

One customer sent us a 5-minute capture from his Cisco ASA 5505. It sent out about 20 different flows types and we still only captured about 15 of the ~20 templates. As you may know, WireShark needs the templates to go back and decipher the flows captured prior. Without the templates, the NetFlow v9 packet capture is pretty much useless.

The default timeout on the Cisco ASA is set for 30 minutes, which is why the screen shot of the capture shown is missing templates.

The customer then applied the following command on the ASA 5505:
hostname(config)# flow-export template timeout-rate 1

The above will force the Cisco ASA to export templates every minute.
NOTE: The template export frequency can be specified by packet rate as well:

Step 5	export template refresh-rate packets Example: Router(config-flow-cache)# export template refresh-rate 10	(Optional) Specifies the refresh rate in number of export packets. packets is an integer from 1 to 600. The default is 20 packets.
Step 6	export template timeout-rate minutes Example: Router(config-flow-cache)# export template timeout-rate 60	(Optional) Specifies the timeout rate in minutes. minutes is an integer from 1 to 3600. The default is 30 minutes.

The above is the topic of another blog.

Oh, and happy birthday mom.  I love you.

Michael Patterson
Scrutinizer Product Manager
Follow Me on Twitter

Tags: Cisco ASA, Cisco ASA 5505, flow-export template timeout-rate, NetFlow v9, NetFlow v9 Templates, Wireshark

This entry was posted on Sunday, June 14th, 2009 at 3:14 am and is filed under NetFlow. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.