Which NetFlow Version: v5, v9, Flexible NetFlow or IPFIX?

Posted in Cisco Medianet, Flexible NetFlow, IPFIX, NetFlow, NetFlow Analyzer, Network Monitoring, Network Traffic Analysis, Network Traffic Monitor on October 26th, 2011 by Dalel
Which NetFlow Version: v5, v9, Flexible NetFlow or IPFIX?
NetFlow v5/v9, Flexible NetFlow and IPFIX are the most popular IP flow formats. In this blog I would like to briefly talk about each of them, so that this information will allow you to better take advantage of everything flow technology has to offer. Features that could change your network traffic analysis experience forever.Application Performance with NetFlow Image

NetFlow v5:  Is the most popular and most basic of all four formats that are being discussed in this blog. It is ideal if you are simply interested in seeing the classic source and destination IP addresses, source and destination ports and the bytes count of transferred data. What makes NetFlow v5 special compared to its predecessors is the added BGP autonomous system information and flow sequence numbers. One limitation of NetFlow v5  is that you can only enable ingress flow export on an interface. Most Cisco devices that are running IOS 11.1 and above support v5.

NetFlow v9: Is an upgrade to NetFlow v5. On top of the traditional flow record of v5, it was an enhancement to support different technologies such as Multi-cast, IPSec, and Multi Protocol Label Switching (MPLS). These enhancements are mostly due to the support for templates which allow the content of the flows to change based on the needs of the user.  For example, due to the routers ability to perform DPI, layer 7 application details can be exported through the use of NBAR.  Also, Voice over IP and video traffic metrics such as jitter, packet loss and round trip time can also be exported.  It also added IPv6 support as well as egress flow collection. V9 is supported in IOS 12.4 and above.

IPFIX: Is the Cisco proposed standard for IP Flow Information eXport and was designed based on NetFlow v9. Several vendors have already adopted IPFIX (e.g. Juniper, Avaya, SonicWALL, nBox, etc.).  It added support for variable length strings.  In the future, Cisco will release Application Visibility and Control (AVC) exports which will take advantage of the variable length string capability and export HTTP host (E.g. netflix.com, youtube.com, facebook.com, etc.).

Flexible NetFlow: Flexible NetFlow is the configuration interface on the router or switch which allows the user to take advantage of NetFlow v9 and IPFIX.  Flexible NetFlow (FnF) allows the user to select the different elements wanted in the flow export. That is why it is said to be “flexible.”  Most of the latest Cisco IOS releases support FnF which can be used to export NetFlow v5, v9 and IPFIX.  In my opinion, it should have been called FlexiFlow. :) heh heh

Find out if your router or switch supports IPFIX or Flexible NetFlow and with the right  analysis tool, you will be taking network monitoring to a new level.

 

Dale

For a free 30 day trial of Scrutinizer, Download Now!

Sign up for Advanced NetFlow Training™ coming to a city near you!

If you enjoyed this post, please consider leaving a comment or subscribing to the RSS feed to have future articles delivered to your feed reader.
Tags: , , , ,

Leave a Reply

You must be logged in to post a comment.