Having an application aware network performance management NetFlow solution will provide greater insight to not only what traffic is traversing the network, but how efficiently the traffic is traversing.

Cisco AVC: Performance Monitoring

A subset of Cisco Application Visibility and Control (Cisco AVC) is Application Response Time (ART).  ART provides the engine to calculate application response times.  ART used to be part of Measurement Aggregation and Correlation Engine (MACE).  As of IOS v15.4.1 and IOS XE 3.8S, ART falls under the performance monitoring feature set.NetFlow Application Monitoring: Application Delay

With traditional NetFlow, the details of the conversation shown in Figure 1 would include the Source/Destination IP Address, Source/Designation Transport Layer Ports, IP Protocol, Type of Service (ToS), and Input Interface.  The typical version 5 NetFlow Tuple

Application Aware

Figure 1: Network Response Times [Cisco]

With Cisco AVC performance monitoring configured, the router can collect an enormous amount of additional details as shown above: Client Network Delay, Server Network Delay, Network Delay, Application Delay, and Total Delay.

Configuring Application Performance Monitoring

Flexible NetFlow is the only way to configure the Cisco Performance Metrics.  When configuring the flow record, the following collect statements will need to be included:

collect connection delay network to-server
collect connection delay network to-client
collect connection delay network client-to-server
collect connection delay response to-server
collect connection delay response client-to-server
collect connection delay application

With the above metrics configured, and the rest of the flexible NetFlow configuration, the example report in figure 2 should become available in your NetFlow solution:

 Performance Monitoring

Figure 2: Connections Application Delay

A final note on ART, it requires monitoring the flow in both directions to generate its calculations. Because of this, “ingress” and “egress” flow monitors are both required on interfaces.

NetFlow Application Monitoring: NBAR2

Along with the performance metrics report as seen above, layer seven application details are also available using Next Generation Network Based Application Recognition (NBAR2).  Here are examples of the types of match and collect statements that can be used with regard to applications:

match application name
collect application http url
collect application http uri statistics
collect application http host
collect application http user-agent
collect application http referer
collect application rtsp host-name
collect application smtp server
collect application smtp sender
collect application pop3 server
collect application nntp group-name
collect application sip source
collect application sip destination

For an exemplar Cisco AVC Configuration, please refer to this blog.  It should be noted that sending these additional flow data metrics will greatly increase the flow volume being sent to the collector.  Please make sure the collector can handle the flow volume and there is ample disk storage.

More on Cisco Application Visibility and Control?

Looking for more information on Cisco AVC?  Check out this webcast presented by Mike Patterson on how Cisco Application Visibility and Control Flow Exports turn Routers into Security Surveillance Solutions.  If you have any questions, feel free to comment below or reach out to the Plixer Support Team at 207-324-8805 x4

Austin Brooks

Austin is a QA Engineer in the R&D department at Plixer. He works on new report types and aids the front end team with changes to the user interface of Scrutinizer. He has worked in Tech Support as well as a Solutions Engineer for the sales team at Plixer before his move to Development. Austin graduated from UNH’s WSBE with a degree in International Business and speaks a bit of German. Outside of work, Austin spends his time honing his coding skills and does website design for friends and family. He enjoys skiing, hockey, playing and writing music as well as traveling to different countries.


Leave a Reply