NetFlow v5: Is the most popular and most basic of all four formats that are being discussed in this blog. It is ideal if you are simply interested in seeing the classic source and destination IP addresses, source and destination ports and the bytes count of transferred data. What makes NetFlow v5 special compared to its predecessors is the added BGP autonomous system information and flow sequence numbers. One limitation of NetFlow v5 is that you can only enable ingress flow export on an interface. Most Cisco devices that are running IOS 11.1 and above support v5.
NetFlow v9: Is an upgrade to NetFlow v5. On top of the traditional flow record of v5, it was an enhancement to support different technologies such as Multi-cast, IPSec, and Multi Protocol Label Switching (MPLS). These enhancements are mostly due to the support for templates which allow the content of the flows to change based on the needs of the user. For example, due to the routers ability to perform DPI, layer 7 application details can be exported through the use of NBAR. Also, Voice over IP and video traffic metrics such as jitter, packet loss and round trip time can also be exported. It also added IPv6 support as well as egress flow collection. V9 is supported in IOS 12.4 and above.
IPFIX: Is the Cisco proposed standard for IP Flow Information eXport and was designed based on NetFlow v9. Several vendors have already adopted IPFIX (e.g. Juniper, Avaya, SonicWALL, nBox, etc.). It added support for variable length strings. In the future, Cisco will release Application Visibility and Control (AVC) exports which will take advantage of the variable length string capability and export HTTP host (E.g. netflix.com, youtube.com, facebook.com, etc.).
Flexible NetFlow: Flexible NetFlow is the configuration interface on the router or switch which allows the user to take advantage of NetFlow v9 and IPFIX. Flexible NetFlow (FnF) allows the user to select the different elements wanted in the flow export. That is why it is said to be “flexible.” Most of the latest Cisco IOS releases support FnF which can be used to export NetFlow v5, v9 and IPFIX. In my opinion, it should have been called FlexiFlow. heh heh
For a free 30 day trial of Scrutinizer, Download Now!
Sign up for Advanced NetFlow Training™ coming to a city near you!Tags: NetFlow v5, NetFlow v9, network traffic monitoring