Since NetFlow is template-based, how does a collector know one template from another? The answer is simple, Intelligent Template Recognition ™. In short, a collector receives flows with packets and uses templates to decode the information in the packets. With Intelligent Template Recognition ™ it automatically knows how to name the templates. But how does the collector know how to name the template?
Intelligent Template Recognition ™
A NetFlow / IPFIX template specifies element IDs and their lengths. The collector decodes these templates and looks for the template name in it’s table of pre-named templates. If an exact match is not found Intelligent Template Recognition ™ is used to name the template. For a detailed analysis on the difference between NetFlow and IPFIX information elements you can read Mike’s blog, it’s riveting!
When the collector does not have a matching pre-defined template definition, Intelligent Template Recognition™ is used. “Cisco: Medianet Custom Flows” is an excellent example of that.
The collector identified that this template contains at least one element ID unique to Cisco Medianet exports. Therefore “Cisco: Medianet” is chosen as the first part. The template also contains a basic flow 5-tuple (source IP, source port, protocol, destination port, destination IP) along with a byte counter, so it was labeled “Flows”. The word “Custom” tells us that this was not a pre-defined description.
SonicWALL is a great example of a vendor who takes matters into their own hands. They export IPFIX templates with information that is not normally found in standard v9 templates.
I love how Cisco coins NetFlow version 9 as “future-proofed” due to it’s flexibility. When a vendor wants to export new information through NetFlow or IPFIX they don’t have to reinvent the technology. They just add new element strings to a template to decode the new information. The job of a great NetFlow collector is to constantly work with vendors to bring you the latest information available in NetFlow.
If you have any other questions, please don’t hesitate to contact us.
