Skip to content
Log in Sign up My account

4.2 Flexible NetFlow

Blueprint 4.2: Configure and verify Flexible NetFlow

  • NetFlow concepts: flows, key and non-key fields, the flow cache, export
  • Traditional NetFlow v5 and v9 compared with Flexible NetFlow and IPFIX
  • The four Flexible NetFlow building blocks: record, exporter, monitor, sampler
  • Applying a monitor to an interface by direction
  • Verifying the cache, the exporter and the collector

The verb is configure and verify. You need to write the three-part configuration from memory, read a flow record to say how packets are grouped, and use the show flow commands to find why nothing reaches the collector.

What NetFlow measures

SNMP tells you how much traffic crossed an interface. NetFlow tells you who talked to whom, with what application, and how much. It does this by grouping packets into flows and keeping one cache entry per flow.

A flow is a set of packets that share the same values in every key field. When a packet arrives, the router builds the key from the packet. If an entry with that key exists, its counters are updated; if not, a new entry is created. Non-key fields are collected and stored but do not create new flows.

Traditional NetFlow (v5) used a fixed seven-field key:

Key field Example
Source IP address 10.10.10.11
Destination IP address 10.20.0.5
Source port 51544
Destination port 443
Layer 3 protocol 6 (TCP)
ToS byte 0
Input interface Gi2

NetFlow versions

Version Format Notes
v5 Fixed record, IPv4 only Most widely supported by old collectors. No IPv6, no MPLS.
v9 Template based The exporter sends a template that describes the record, then the data. Supports IPv6 and custom fields.
IPFIX Template based, IETF standard Based on v9 (sometimes called "v10").
Flexible NetFlow The IOS XE configuration framework You define the record. Exports as v9 by default, or IPFIX.

Exam trap

"Flexible NetFlow" is not an export format. It is the configuration model (record, exporter, monitor). The bits on the wire are NetFlow v9 or IPFIX. Questions that ask which export version supports user-defined records and IPv6 want v9 (or IPFIX), never v5.

The building blocks

graph LR
  REC["flow record<br/>match = key<br/>collect = non-key"] --> MON["flow monitor<br/>cache + timeouts"]
  EXP["flow exporter<br/>collector, port, source"] --> MON
  SAM["sampler<br/>optional, 1 out-of N"] -.-> INT
  MON -->|"ip flow monitor MON input"| INT["Interface Gi2"]
  INT -->|"UDP export"| COL["Collector 192.168.100.50"]
Block What it defines Required
flow record Key fields (match) and non-key fields (collect) Yes, or use a predefined record
flow exporter Collector address, transport port, source interface, version Only if you want export. The cache works without it.
flow monitor Ties a record to one or more exporters, holds the cache and its timeouts Yes
sampler Samples 1 out of N packets to reduce CPU load No

Flow record

flow record APP-RECORD
 description Who talks to whom, on which port
 match ipv4 source address
 match ipv4 destination address
 match ipv4 protocol
 match transport source-port
 match transport destination-port
 match interface input
 collect interface output
 collect counter bytes long
 collect counter packets long
 collect timestamp absolute first
 collect timestamp absolute last
 collect transport tcp flags

Everything after match is a key. Everything after collect is a value stored per flow. Choose keys carefully: a record keyed only on source and destination address merges all conversations between two hosts into one flow, which is ideal for a "top talkers" report but useless for application analysis.

Predefined records exist for the classic behaviour, for example record netflow ipv4 original-input reproduces the traditional v5-style key.

Flow exporter

flow exporter TO-COLLECTOR
 description Linux nfcapd collector
 destination 192.168.100.50
 source Loopback0
 transport udp 2055
 export-protocol netflow-v9
 template data timeout 60
 option interface-table
  • destination and transport udp must match where the collector listens. Common collector ports are 2055, 9995 and 9996, and IPFIX uses 4739, but there is no single standard, so always configure the port.
  • source sets the export source address. Use a loopback so the collector sees one stable address.
  • template data timeout resends v9/IPFIX templates periodically. A collector that starts after the router cannot decode data until it receives a template.
  • option interface-table exports SNMP ifIndex to name mappings so the collector can show interface names.
  • destination can take vrf NAME when the collector is reached through a VRF.

Flow monitor

flow monitor APP-MONITOR
 description Applied inbound on user-facing interfaces
 record APP-RECORD
 exporter TO-COLLECTOR
 cache timeout active 60
 cache timeout inactive 15
Cache timer Default Meaning
Active timeout 1800 seconds A long-lived flow is exported every active seconds, even though it is still running
Inactive timeout 15 seconds A flow with no packets for inactive seconds is exported and removed

Long downloads are invisible on the collector for 30 minutes with the default active timer, so lower it to 60 seconds for useful graphs. TCP flows are also expired when a FIN or RST is seen.

Applying the monitor

interface GigabitEthernet2
 ip flow monitor APP-MONITOR input
 ip flow monitor APP-MONITOR output
 ipv6 flow monitor APP-MONITOR-V6 input

The direction is relative to the interface. input monitors packets as they arrive. Monitoring input on every interface is the usual design, because it captures every flow exactly once; monitoring both input and output everywhere counts each transit flow twice.

Sampler

sampler ONE-IN-100
 mode random 1 out-of 100
!
interface GigabitEthernet3
 ip flow monitor APP-MONITOR sampler ONE-IN-100 input

Sampling cuts CPU and cache use on high-speed links at the cost of accuracy for small flows.

Exam trap

A monitor references a record by name. You cannot change the record or remove an exporter that is in use while the monitor is applied to an interface. Remove ip flow monitor from the interfaces first, edit, then re-apply. Exam items that say "the change is rejected" often hinge on this.

Verification

R1# show flow monitor APP-MONITOR
Flow Monitor APP-MONITOR:
  Description:       Applied inbound on user-facing interfaces
  Flow Record:       APP-RECORD
  Flow Exporter:     TO-COLLECTOR
  Cache:
    Type:                 normal (Platform cache)
    Status:               allocated
    Size:                 200000 entries
    Inactive Timeout:     15 secs
    Active Timeout:       60 secs

R1# show flow monitor APP-MONITOR cache format table
  Cache type:                               Normal (Platform cache)
  Cache size:                               200000
  Current entries:                          4

IPV4 SRC ADDR    IPV4 DST ADDR    TRNS SRC PORT  TRNS DST PORT  INTF INPUT  IP PROT  bytes long  pkts long
===============  ===============  =============  =============  ==========  =======  ==========  =========
10.10.10.11      10.20.0.5                51544            443  Gi2               6     1846233       1290
10.10.10.11      10.20.0.5                51546            443  Gi2               6       12455         31
10.10.10.12      8.8.8.8                  60211             53  Gi2              17          71          1
10.10.10.12      10.255.255.2                 0           2048  Gi2               1         500          5

The cache shows four flows (columns trimmed for width). The two HTTPS flows from 10.10.10.11 are separate because the source port is a key field. In the last row the "destination port" of an ICMP flow holds the ICMP type and code (2048 = type 8, code 0, an echo request), which is how NetFlow represents ICMP.

R1# show flow exporter TO-COLLECTOR statistics
Flow Exporter TO-COLLECTOR:
  Packet send statistics (last cleared 00:12:40 ago):
    Successfully sent:         142                   (175320 bytes)

  Client send statistics:
    Client: Flow Monitor APP-MONITOR
      Records added:           1311
        - sent:                1311
      Bytes added:             68172
        - sent:                68172

Other useful commands:

Command Shows
show flow record APP-RECORD The key and non-key fields
show flow exporter TO-COLLECTOR Destination, port, source, version, and the export status
show flow interface GigabitEthernet2 Which monitors are applied and in which direction
show flow monitor APP-MONITOR statistics Flows added and aged, cache usage
show running-config flow monitor The configured objects

Troubleshooting checklist

Symptom Likely cause
Cache is empty Monitor not applied, or applied in the wrong direction for the traffic you expect
Cache fills, collector sees nothing Wrong destination or port, ACL or firewall blocking UDP, no route to the collector, or the export source address is not routable back
Collector shows "unknown template" v9/IPFIX templates not yet received; wait for the template timeout or restart the collector before the router
Long flows appear late Active timeout still at 1800 seconds
Traffic doubled on reports Monitor applied input and output on transit interfaces
Monitor change rejected Monitor is applied to an interface; remove it first

Exam trap

The flow exporter source must be an interface with an address the collector can route back to, and the collector often filters on the expected source IP. Changing the exit interface without source Loopback0 can make exports suddenly "disappear" from the collector after a routing change.

Lab: Flexible NetFlow to a Linux collector

Topology: Host1 (10.10.10.11) behind R1 Gi2, R1 to R2 on Gi3 (10.1.12.0/30), R2 Loopback0 10.255.255.2. R1 Gi1 in the management subnet with an Ubuntu collector at 192.168.100.50.

graph LR
  H1["Host1 10.10.10.11"] -- "Gi2 10.10.10.1/24" --- R1["R1 C8000v"]
  R1 -- "Gi3 10.1.12.1/30" --- R2["R2 Lo0 10.255.255.2"]
  R1 -- "Gi1 192.168.100.1" --- COL["Collector 192.168.100.50"]
  1. On the collector, install the nfdump package and run nfcapd -w /tmp/nf -p 2055 so it listens on UDP 2055. Options differ slightly between nfdump releases, so check nfcapd -h if the command is rejected.
  2. On R1, configure APP-RECORD, TO-COLLECTOR and APP-MONITOR exactly as shown above, with cache timeout active 60.
  3. Apply ip flow monitor APP-MONITOR input on Gi2 and Gi3.
  4. From Host1, ping 10.255.255.2 and open a few TCP sessions (for example curl to any web server reachable through R2, or nc 10.255.255.2 22).
  5. Check show flow monitor APP-MONITOR cache format table and show flow exporter TO-COLLECTOR statistics.
  6. After a minute, run nfdump -R /tmp/nf on the collector and find the same flows.
  7. Break it: change the exporter to transport udp 9999. The router still reports "Successfully sent" (UDP has no acknowledgement) but nfdump sees nothing new. That is the lesson: exporter statistics prove the router sent, not that the collector received.
  8. Try to remove collect transport tcp flags from the record. Read the error, remove the monitor from both interfaces, make the change and re-apply.

Expected verification:

R1# show flow interface GigabitEthernet2
Interface GigabitEthernet2
  FNF:  monitor:         APP-MONITOR
        direction:       Input
        traffic(ip):     on

For the combined timed exercise with IP SLA, do Sim 09.

Quick check

A record has match ipv4 source address and match ipv4 destination address only. A host opens ten HTTPS sessions to one server. How many flows are in the cache?

One. Ports are not key fields, so all ten sessions share the same key. Their packets and bytes are added to one entry.

Which part of Flexible NetFlow defines the collector's UDP port?

The flow exporter, with transport udp <port>.

Why lower the active timeout from its default?

The default active timeout is 1800 seconds, so a long flow is exported only every 30 minutes. A lower value (60 seconds) gives the collector near-real-time data for long-lived flows.

References