Blog :: Network Operations :: Security Operations

Catalyst 4948E NetFlow-Lite and IPFIX Support: NetFlow Monitor

PSAMP is what allows the Catalyst 4948E to support NetFlow-Lite and it is the first switch from Cisco to support IPFIX.  This feature demonstrates Cisco’s commitment to IPFIX, a protocol slowly gaining ground on Cisco’s NetFlow in popularity.  The main difference being that IPFIX is the proposed flow standard in RFC 5101 and 5102.  Did you know that Cisco is one of the major proponents of IPFIX?Flexible NetFlow has been around for about 4 years, is based on NetFlow v9, yet remains less popular than NetFlow v5.  Why?  It is largely because of the amount of user configuration required to implement it, combined with the lack of features available — unless the company is willing to upgrade the IOS.   NBAR, Performance Monitoring and Performance Routing exports via Flexible NetFlow all require IOS v15.X or more recent.

How NetFlow-Lite Works

The Catalyst 4948E samples packets on one or more of its interfaces and sends each packet off to an nProbe in a separate NetFlow datagram.  The nProbe acts as the NetFlow-Lite aggregator which combines the samples into flows and then forwards the flows off to a NetFlow monitor which will provide the collection and NetFlow reporting.  The nProbe will leave the source IP address of the datagrams intact when the flows are forwarded to the NetFlow monitor.  In turn, the NetFlow monitor will think it is receiving the NetFlow datagrams directly from the Catalyst 4948E.  I should note that Configuring NetFlow-lite is not a difficult process.  Make sure you send the NetFlow-Lite to the NetFlow aggregator (aka nProbe) which in turn will send the flows to the NetFlow collector for reporting and analysis. NetFlow Lite is an ideal technology for those who need to scale down their NetFlow collector.  Sure, flow based technology uses minimal bandwidth (an increase of 2% to 3% of active traffic), however, can your hardware save 100,000 flows/second?  Is your collector putting a strain on your hard drive? Analyzer Taxing your Hardware? Our enterprise NetFlow collector appliance is a solution that you may want to look at if you are dealing with high volumes of flows.

sFlow Vs. NetFlow

NetFlow-Lite is a sampling technology similar to sFlow however, sFlow is not a flow technology at all.  It is a packet sampling technology which has little to do with flows.  A flow represents a series of packets with the same uniquely definable tuple.  When Plixer entered the NetFlow market several years ago, we thought sFlow could become popular.   Although sFlow continues to be deployed, the technology itself lacks recent innovation. If you have questions on NetFlow Lite, sFlow Vs. NetFlow or on how to deploy these technologies, give us a ring.