Cisco NetFlow v9: TTLs and MACs and VLANs, oh my!

Every once in a while I need to stretch my legs, and generally I go to see how the developers are doing up in the penthouse. Although they occupy the premium space here at Plixer, the penthouse has no windows. The view wouldn’t have been that great anyway as the penthouse overlooks the parking lot. Anyway, I went over to the coffee machine to get a cup of premium Joe (another perk). I spotted the quarter jar and looked both ways to see if anyone was watching.  I’m kidding…. I always pay.

I dropped in on the lab, and my counterpart, Mr. Flow Analytics had his nose almost pressed against his monitor. What are you up to? “Cool stuff,” he said. Then he brought up Wireshark and showed me some very interesting new fields available in Cisco NetFlow version 9 and IPFIX. Click to enlarge the screen capture below:

 

Notice the SRC_VLAN, SRC_MAC, etc.  These are all new fields and few Cisco NetFlow reporting software packages report on them. Very nice. Anyone interested in reporting on VLANs or MAC addresses using Cisco NetFlow?  Please contact me.

BTW: These are the new commands he typed into the Cisco 2800 router:

• ip flow-capture fragment-offset
• ip flow-capture ttl
• ip flow-capture vlan-id
• ip flow-capture icmp
• ip flow-capture ip-id
• ip flow-capture mac-addresses

The used Cisco 2800 router we purchased is now running alpha code from Cisco Systems, which  we are testing for some additional advanced features that can’t be discussed just yet. I don’t want to get in trouble with Cisco like Mix Master Mitch.

Sadly, not all my walks are this eventful, but I’ll be sure to check in on the developers again soon to keep you all informed.