Home > NetFlow Tutorial

NetFlow Tutorial

May 13th, 2016 Go to comments

Note: NetFlow is no longer a topic in CCNAv3 200-125 exam.

One of the most important tasks of a network administrator is to monitor the health of our networks, learn how our bandwidth is being used, what applications are consuming it, when it needs upgrade… Although monitoring protocols like SNMP and SPAN (port mirroring) can help us answer some questions but they are not enough to give us an insightful view of our networks. Luckily we have another amazing tool: NetFlow!

NetFlow is a networking analysis protocol that gives the ability to collect detailed information about network traffic as it flows through a router interface. NetFlow helps network administrators answers the questions of who (users), what (application), when (time of day), where (source and destination IP addresses) and how network traffic is flowing.

Let’s take an example! In the topology below, when traffic from Network 1, 2, 3… passes through the interfaces of a NetFlow enabled device, relevant information is captured and stored in the NetFlow cache. NetFlow collects IP traffic information as records and sends them to a NetFlow collector for traffic flow analysis.


NetFlow components

+ NetFlow Monitor: a component applied to an interface and collects information about flows. Flow monitors consist of a record and a cache. You add the record to the flow monitor after the flow monitor is created. In the topology above, we can apply the NetFlow Monitors to the s0/0, Fa0/0 and Fa0/1 interfaces of the router to collect traffic information of these interfaces
+ NetFlow Exporter: aggregates packets into flows, stores IP flow information in its NetFlow cache and exports them in the form of flow records to the NetFlow collector
+ NetFlow Collector: collects flow records sent from the NetFlow exporters, parsing and storing the flows. Usually a collector is a separate software running on a network server. NetFlow records are exported to a NetFlow collector using User Datagram Protocol (UDP)
+ NetFlow Sampler: used to reduce the number of packets that are selected for analysis. It is applied to a NetFlow Monitor to reduce the overhead load because the number of packets that the flow monitor must analyze is reduced. But notice that the accuracy of the information stored in the flow monitor’s cache is also reduced correspondingly.

Note: The term “flows” here should be understood as “unidirectional streams of related packets”

The most important component of NetFlow is the NetFlow Exporter (and its NetFlow cache) so we will discuss more about it.

How NetFlow Exporter works

When packets arrive at the NetFlow Exporter, each of them is inspected for one or many IP packet attributes. These attributes are used to determine if the packet is unique or similar to other packets. If it is similar then it is classified as in the same flow.


There are seven key IP packet attributes that can be used by NetFlow to classify packets into separate flows:
+ IP source address
+ IP destination address
+ Source port
+ Destination port
+ Layer 3 protocol type
+ Class of Service (or Type of Service – ToS) Byte
+ Input (Router or switch) interface

Other attributes can be also used and they are called non-key attributes such as timestamps, packet and byte counters, TCP flag information…

After inspecting these attributes, the NetFlow Exporter condenses them into flow records and save in a database called the NetFlow cache. These flow records can also be exported to a NetFlow Collector.

How to view NetFlow data

There are two main methods to view NetFlow data:

+ Command Line Interface (CLI): Because the NetFlow cache is a part of the NetFlow Exporter so we can view this cache directly via the Command-Line-Interface (CLI), which is very useful for troubleshooting, with the “show ip cache flow” command. An example output of this command is shown below:


+ A NetFlow reporting tool: there are many tools that can collect NetFlow packets sent to the NetFlow Collector and display a comprehensive view. Below is an example of what SolarWinds NetFlow Traffic Analyzer can analyze:


NetFlow versions

Version 1: the original format supported in the initial NetFlow releases.
Versions 2, 3 and 4 were not released.
Version 5: an enhancement that adds Border Gateway Protocol (BGP) autonomous system information, flow sequence numbers and a few additional fields. This is the standard and most common NetFlow version. Only support IPv4.
Version 6: similar to version 7
Version 7: Cisco-specific version for Catalyst 5000 series switches but not compatible with Cisco routers
Version 8: choice of aggregation schemes in order to reduce resource usage
Version 9: support flow-record format and it is known as Flexible NetFlow technology. NetFlow version 9 includes a template to describe what is being exported. It supports extensible file export format to enable easier support. It also supports additional fields & technologies such as MPLS, IPv6, IPSec, NBAR protocols, Multicast, VLAN ID…

In general, the two most important NetFlow versions are Version 5 and Version 9 which we will learn how to configure them.

Note: NetFlow version 5 only supports monitoring inbound statistics using the “ip flow ingress” command while NetFlow v9 allows to monitor traffic leaving each interface via “ip flow egress” command.

In the next part we will learn how to configure NetFlow version 5 & 9.

Comments (30) Comments
Comment pages
1 2 3 5 2795
  1. Lonelyman
    May 15th, 2016

    Many thank 9tut!

  2. donlico
    May 15th, 2016

    Thank you for this amazing tutorial… I have only one question? In NetFlow Version 9 during the configuration where is the command that tell the router to export through Fa0/2?

  3. 9tut
    May 16th, 2016

    @donlico: Thanks for your concern! We made a mistake: NetFlow will decide which interface to export based on its routing table. The command “ip flow-export source fa0/2” only instructs to use its Fa0/2 IP address as the source IP address for the UDP datagrams. We have just updated this tutorial.

  4. Kurama
    May 16th, 2016

    Thank you!!!

  5. Motayeb
    May 17th, 2016

    i hate you

  6. Motayeb
    May 17th, 2016

    i love you

  7. donlico
    May 18th, 2016

    Thank you for the first answer… I have a second question… In version 9 is the same command like in version 5 about the time or in this version 9 the default time is 1 minute?

  8. Anonymous
    May 18th, 2016

    i hate that i love you

  9. king
    May 18th, 2016

    Thank you

  10. Kulang
    May 20th, 2016

    hello everyone I will be writing my ccna exam next month can anyone plz help me with valid dumps

  11. Anonymous
    May 24th, 2016

    Thank you.

  12. fan of kulang
    May 27th, 2016

    you are so kind, sweet

  13. siddhesh
    May 27th, 2016

    How much time will be sufficient for preparation of CCNA-100-120 exam.?
    Please Let me know, if anyone have a same exam preparation experience.
    Kindly suggest.
    Thank You well In Advance…

  14. Dee
    May 28th, 2016

    Ladies and Gents 9tut is for those who really wanna nail these exams, of which I doubt someone doesnt want to

  15. Arman G Athar
    May 29th, 2016

    If u Want Latest Dumps And Labs Contect {email not allowed}

  16. Bond
    June 4th, 2016

    Thanks Admin bro

  17. Ma
    June 8th, 2016

    Hie guys can some send me the latest dumps for ccna
    thank you….

  18. admin
    June 14th, 2016

    Hi friends..

    I would like to write the CCNA exam…. if any body having the latest dumps pl share me…
    thank you..

  19. Nikhil
    June 19th, 2016

    Im giving my exam on monday! im just gonna do all the sims from here, i hope that does it for me

  20. Rasool khan Ahmadzai
    June 21st, 2016

    Hi every one if any one of you have the CCNA latest dumps please share with me Thank you
    {email not allowed}

  21. Zahia
    June 23rd, 2016

    Where can I find the PDF questions Please ??

  22. standardgis
    June 23rd, 2016

    How do I see the questions? If you know of data dump, please send to standardGIS @ gmail . com thanks. Thanks guys and good luck!

  23. Test
    June 23rd, 2016

    Hey guys, I passed today the CCNA, pay attention to Netflow, there is always 1 or 2 questions on it, and every question counts !

    Same for IPv6, syslog (about message logging) and SNMP (differences between versions, encryption type) ! Good Luck !

  24. Andres
    June 28th, 2016

    @Test: Wich were the sources that you studied to prepare CCNA exam?

  25. dinesh
    June 29th, 2016

    Hi friends..
    if any body having the latest CCNA(R&S) dumps pls send on email {email not allowed}
    thank you..

  26. Jacky
    June 30th, 2016

    where is the next session? i need to know the configuration to make a visualisation

  27. Shina
    June 30th, 2016

    Hi everybody, i am new in this group…just wanna need your guiding and mentoring. Tanx

  28. Omar
    July 1st, 2016

    Please email me latest CCNA(R&S) dump to omarsalee @ gmail.com

  29. Bruteforce Attack!
    July 5th, 2016

    am in dare of latest dumps and if anybody has them please share with me via email {email not allowed}.


  30. Zeeshan
    July 9th, 2016

    I need latest dump of CCNA (R& S) if anyone has it please send it to my email ID: rzeeshan.mehboob @ gmail.com Thanks & Best Regards,

Comment pages
1 2 3 5 2795
Add a Comment