In the configuration terminal on the router, issue the following to start NetFlow Export.
It is necessary to enable NetFlow on all interfaces through which traffic you are interested in will flow.
Now, verify that the router is generating flow stats - try 'show ip cache flow'. Note that for routers with distributed
switching (GSR's, 75XX's) the Rendezvous Point CLI will only show flows that made it up to the RP. To see flows on
the individual linecards use the 'attach' or 'if-con' command and issue the 'show ip cache flow' on each LC.
Enable export of these flows with the global commands. 'ip flow-export source' can be set to any interface, but one which
is the least likely to enter a 'down' state is preferable. Netflow will not be exported if the specified source is down.
For this reason, we suggest the Loopback interface, or a stable Ethernet interface:
router(config)# ip flow-export version 5
router(config)# ip flow-export destination <ip-address> <port>
router(config)# ip flow-export source FastEthernet0
Use the IP address of your NetFlow Collector and configured listening port.
If your router uses BGP protocol, you can configure AS to be included in exports with command:
router(config)# ip flow-export version 5 [peer-as | origin-as]
The following commands break up flows into shorter segments.
router(config)# ip flow-cache timeout active 1
router(config)# ip flow-cache timeout inactive 15
Use the commands below to enable NetFlow on each physical interface (i.e. not VLANs and Tunnels, as they are auto
included) you are interested in collecting a flow from. This will normally be an Ethernet or WAN interface. You may also need to
set the speed of the interface in kilobits per second. It is especially important to set the speed for frame relay or ATM virtual circuits.
interface <interface>
ip route-cache flow
bandwidth
Now write your configuration with the 'write' or 'copy run start' commands. When in enabled mode, you can see current NetFlow
configuration and state with the following commands:
router# show ip flow export
router# show ip cache flow
router# show ip cache verbose flow
Ip flow-export source <int-name>
Ip flow-export version 5
Ip flow-export destination <ip-address> <port>
Ip flow-cache timeout active 1
Enter the following command on each physical interface. You will need to log into each interface one at a time.
Ip route-cache flow
Switch side:
Set mls nde <ip-address> <port>
Set mls nde version 5
Set mls flow full
Set mls agingtime long 128
Set mls agingtime 64
Set mls bridged-flow-statistics enable
Set mls nde enable
Enter the following global commands (all commands are entered in the router <enable> config t option).
Ip flow-export source <int-name>
Ip flow-export version 5
Ip flow-export destination <ip-address> <port>
Ip flow-cache timeout active 1
Mls nde sender version 5
Mls flow ip interface-full
Mls nde interface
Mls aging long 64
Mls aging normal 64
Enter the following command on each physical interface. You will need to log into each interface one at a time.
To enable the flow statistics feature on a switch, use the following command:
enable flowstats
The flow statistics feature is disabled by default.
To disable the flow statistics feature on a switch, use the following command:
disable flowstats
To enable the flow statistics function on the specified port, use the following command:
enable flowstats ports <portlist>
The flow statistics function is disabled by default.
To disable the flow statistics function on the specified port, use the following command:
disable flowstats ports <portlist>
A single port can distribute statistics across multiple groups of flow-collector devices. This NetFlow distribution capability makes it possible to create a collection architecture that scales to accommodate high volumes of exported data. It also offers a health-checking function that improves the reliability of the collection architecture by ensuring that only responsive flow-collector devices are included in active export distribution lists. The distribution algorithm also ensures that all the ingress flow records for a given flow are exported to the same collector.
NetFlow distribution is enabled by configuring export distribution groups that identify the addresses of multiple flow-collector devices. You can configure up to 32 export distribution groups on a BlackDiamond 6800 series switch, and each group can contain as many as eight flow-collector devices.
To configure the export groups and flow-collector devices to which NetFlow datagrams are exported, use the following command:
The group# parameter is an integer in the range from 1 through 32 that identifies the specific group for which the destination is being configured.
You can use the add and delete keywords to add or delete flow-collector destinations.
To export NetFlow datagrams to a group, you must configure at
least one flow-collector destination. By default, no flow-collector
destinations are configured. To configure a flow-collector destination,
use either an IP address and UDP port number pair or a hostname
and UDP port number pair to identify the flow-collector device to
which NetFlow export datagrams are to be transmitted. You can configure
up to eight flow-collector destinations for each group. When multiple
flow-collectors are configured as members of the same group, the
exported NetFlow datagrams are distributed across the available destinations.
To configure the IP address that is to be used as the source IP address for NetFlow datagrams to be exported, use the following command:
config flowstats source <ipaddress>
By default, flow records are exported with the VLAN interface address that has a route to the configured flow-collector device.
Depending on how it is configured, a flow-collector device can use the source IP address of received NetFlow datagrams to identify
the switch that sent the information.
The following command example specifies that the IP address 192.168.100.1 is to be used as the source IP address for exported NetFlow datagrams.
config flowstats source 192.168.100.1
Flow records are exported on an age basis. If the age of the flow record is greater than the configured time-out, the record is exported.
To configure the time-out value for flow records on the specified port, use the following command:
The time-out value is the number of minutes to use in deciding when to export flow records. The default time-out is 5 minutes.
The following command example specifies a 10-minute time-out for exported NetFlow datagrams on port 1 of the Ethernet module installed in slot 8 of the BlackDiamond switch.
config flowstats timeout 10 ports 8:1
To reset the flow statistics configuration parameters for a specified Ethernet port to their default values, use the following command:
unconfig flowstats ports <portlist>
To display status information for the flow statistics function, use the following command:
show flowstats {detail | group <group#> | ports <portlist>}
where:
detail
Use this optional keyword to display detailed NetFlow configuration information.
group#
Use this optional parameter with the group keyword to display status information for a specific export group.
portlist
Use this optional parameter to specify one or more ports or slots and ports for which status information is to be displayed.
If you enter the show flowstats command with none of the optional keywords or parameters, the command displays a summary of status information for all ports.
The summary status display for a port shows the values for all flow statistics configuration parameters for the port.
The summary status display for an export group includes the following information:
Values for all configuration parameters
Status of each export destination device
The detailed status display for an export group includes the summary information, plus the following management information:
Counts of the number of times each flow collector destination has been taken out of service due to health-check (ping check) failures
Juniper supports flow exports by sampling packet headers with the routing engine
and aggregating them into flows. Packet sampling is acheived by defining a firewall
filter to accept and sample all traffic, applying that rule to an interface, and
then configuring the sampling forwarding option.
interfaces {
ge-0/1/0 {
unit 0 {
family inet {
filter {
input all;
output all;
}
address <network>/<mask>(<- This is in binary notation)
}
}
}
}
firewall {
filter all {
term all {
then {
sample;
accept;
}
}
}
}
forwarding-options {
sampling {
input {
family inet {
rate 100;
}
}
output {
cflowd {
port <port>;
version <version_number>;
}
}
}
}
Below are examples of how to enable Traffic-Flow on a router.
Enable Traffic-Flow on the router:
[admin@MikroTik] ip traffic-flow> set enabled=yes
[admin@MikroTik] ip traffic-flow> print
enabled: yes
interfaces: all
cache-entries: 1k
active-flow-timeout: 30m
inactive-flow-timeout: 15s
[admin@MikroTik] ip traffic-flow>
Specify IP address and port of the host, which will receive Traffic-Flow packets:
[admin@MikroTik] ip traffic-flow target> add address=192.168.0.2:2055 \
\... version=9
[admin@MikroTik] ip traffic-flow target> print
Flags: X - disabled
# ADDRESS VERSION
0 192.168.0.2:2055 9
[admin@MikroTik] ip traffic-flow target>
sflow receiver 1 name address udp-port packet-size 1400 version 5 timeout 0
Receiver Name can be set to any one-word string you want (e.g. Scrutinizer). Port should be set to 2055 by default. Packet-size should be set to 1400, version should be 5, and timeout should be 0.
Next, configure a sampler on all desired interfaces:
The following commands configure a Force10 switch/router with IP address 1.1.2.2 to sample at 1-in-512 and send the sFlow packets to Scrutinizer with IP address 1.1.1.1 over UDP port 6343:
Force10(conf)#sflow collector 1.1.1.1 agent-addr 1.1.2.2
Force10(conf)#sflow sample-rate 512
Force10(conf)#sflow enable
sFlow must then be enabled on every interface that should be sampled: Force10(conf-if-gi-0/0)#sflow enable
To list the configuration settings use the command: Force10#show sflow
sFlow services are enabled
Global default sampling rate: 512
Global default counter polling interval: 20
Global extended information enabled: none
1 collectors configured
Collector IP addr: 1.1.1.1, Agent IP addr: 1.1.2.2, UDP port: 6343
20088 UDP packets exported
0 UDP packets dropped
3940 sFlow samples collected
0 sFlow samples dropped due to sub-sampling
Linecard 0 Port set 0 H/W sampling rate 512
Gi 0/0: configured rate 512, actual rate 512, sub-sampling rate 1
IMPORTANT: 2800 Series must be running Software Revision I.08.105 and Firmware (ROM) version I.08.07 5300 Series must be running Software Revision E.10.37 or higher
For information on enabling sFlow on 2800 or 5300 series HP Procurve Switches, download this ZIP file and review the PDF inside for further instructions.
HP has added support for configuring sFlow directly on the CLI.
From config mode:
Configure destination collector
sflow <1-3> destination
where 1-3 is the sFlow instance, IP-addr is the address of the Scrutinizer collector, and udp-port-for-sflow is the number of the listening port of the collector.
example: sflow 1 destination 192.168.1.1 6343
Activate Sampling
sflow <1-3> sampling N
where 1-3 is the sFlow instance, ports list is the port(s) setup for sFlow, and N is the number of sampled packets (to sample every 100 packets set N to 100).
example: sflow 1 sampling all 100
Activate Polling
sflow <1-3> polling N
where 1-3 is the sFlow instance, ports list is the port(s) setup for sFlow, and N is the number of interval (in seconds) between polling intervals.
NetFlow (AKA NetStream) is supported on the 5000 & 6000 routers via software upgrade and on the 8800 Switch via an NMM module.
To configure NetStream on a 3Com 5012 router, use the following sample configuration:
ip netstream export source interface <Interface>
ip netstream export host <IP address> <port number>
Then activate NetStream on each specific interface you want to obtain statistics from. For example, on the Serial0/0 interface, use the following command.
interface s0/0
ip netstream inbound
This will export inbound NetStream traffic statistics related to the Serial0/0 interface of the 3com router to the workstation running Scrutinizer.
This Configuration Guide shows how to enable IPFIX using Java Device Manager (JDM) or with the Command Line Interface. (See Chapter 4).
NOTE: The 5500 series only supports IP packet sampling resulting in lower than actual utilization trends.
Utilization can be understated on Nortel IPFIX capable equipment. To fix this issue, review the hash overflow document.
Click here to learn how to verify that NetFlow is coming into Scrutinizer!
Below is a more in depth overview on some of the commands that can be involved.
Set this <interface number> value for example to: FastEthernet0/0. This specifies the interface that the NetFlow is going to be sent from. This is recommended because if the router is restarted and the interface number changes or if a backup connection goes active, the interface the flow is coming from will appear to not have changed. This is important as we don’t want to lose historical data.
Also, using a loopback address allows for real interfaces to go down and if there is still a route back to Scrutinizer the NetFlow packets will make it. If you don’t use this command, the following example could occur: if you have configured the source as wan interface 1 and it goes down but, there is a route back via wan interface 2 then the NetFlow may not get sent to Scrutinizer even though the network connection is active and traffic is being passed.
Command to type: ip flow-export source <interface number>
The command below breaks up long-lived flows into 1-minute segments. You can choose any number of minutes between 1 and 60; if you leave the default of 30 minutes you will get spikes in your utilization reports.
Command to type: ip flow-cache timeout active 1
Use the command below to specify the IP ADDRESS (e.g. 10.1.1.5) of your Scrutinizer Host and the "Listener Port" specified in the Configuration under the Settings tab. Port 2055 is monitored by default.
Command to type: ip flow-export destination <IP ADDRESS> 2055
The source interface is used to set the source IP address of the NetFlow exports sent by the router. Scrutinizer may send SNMP requests to the router using this address. Use the command below if you experience problems. You can set the source interface to an Ethernet or WAN interface instead of the loopback.
Command to type: ip flow-export source loopback 0
Use the command below to set the export version. Version 5 is the most recent full export version supported by routers.
Command to type: ip flow-export version 5
The command below ensures that flows that have finished are exported in a timely manner. The default is 15 seconds; you can choose any value between 10 and 600. Note however that if you choose a value that is longer than 250 seconds Scrutinizer may report traffic levels that appear low.
Command to type: ip flow-cache timeout inactive 15
Use the command below to display the current NetFlow configuration. Issue this in normal (not configuration) mode!
Command to type: show ip flow export
Issue these commands in normal mode to summarise the active flows and to give an indication of how much NetFlow data is being transmitted by the router.
Command to type: show ip cache flow
Command to type: show ip cache verbose flow
This enables Cisco Express Forwarding, which is required for NetFlow in most recent IOS releases.
For more information and a list of dependencies for the CISCO-NETFLOW-MIB, use the Cisco SNMP Object Navigator.
Learn more about configuring NetFlow on your router or switch at the Cisco website.
"The beauty of NetFlow is, because it is a standard, you can look at data from different vendors and still apply the correct level of forensics or traffic analysis to it."
