Home > NetFlow Tutorial

NetFlow Tutorial

May 13th, 2016 Go to comments

Note: NetFlow is no longer a topic in CCNAv3 200-125 exam.

One of the most important tasks of a network administrator is to monitor the health of our networks, learn how our bandwidth is being used, what applications are consuming it, when it needs upgrade… Although monitoring protocols like SNMP and SPAN (port mirroring) can help us answer some questions but they are not enough to give us an insightful view of our networks. Luckily we have another amazing tool: NetFlow!

NetFlow is a networking analysis protocol that gives the ability to collect detailed information about network traffic as it flows through a router interface. NetFlow helps network administrators answers the questions of who (users), what (application), when (time of day), where (source and destination IP addresses) and how network traffic is flowing.

Let’s take an example! In the topology below, when traffic from Network 1, 2, 3… passes through the interfaces of a NetFlow enabled device, relevant information is captured and stored in the NetFlow cache. NetFlow collects IP traffic information as records and sends them to a NetFlow collector for traffic flow analysis.

NetFlow_example.jpg

NetFlow components

+ NetFlow Monitor: a component applied to an interface and collects information about flows. Flow monitors consist of a record and a cache. You add the record to the flow monitor after the flow monitor is created. In the topology above, we can apply the NetFlow Monitors to the s0/0, Fa0/0 and Fa0/1 interfaces of the router to collect traffic information of these interfaces
+ NetFlow Exporter: aggregates packets into flows, stores IP flow information in its NetFlow cache and exports them in the form of flow records to the NetFlow collector
+ NetFlow Collector: collects flow records sent from the NetFlow exporters, parsing and storing the flows. Usually a collector is a separate software running on a network server. NetFlow records are exported to a NetFlow collector using User Datagram Protocol (UDP)
+ NetFlow Sampler: used to reduce the number of packets that are selected for analysis. It is applied to a NetFlow Monitor to reduce the overhead load because the number of packets that the flow monitor must analyze is reduced. But notice that the accuracy of the information stored in the flow monitor’s cache is also reduced correspondingly.

Note: The term “flows” here should be understood as “unidirectional streams of related packets”

The most important component of NetFlow is the NetFlow Exporter (and its NetFlow cache) so we will discuss more about it.

How NetFlow Exporter works

When packets arrive at the NetFlow Exporter, each of them is inspected for one or many IP packet attributes. These attributes are used to determine if the packet is unique or similar to other packets. If it is similar then it is classified as in the same flow.

NetFlow_Exporter.jpg

There are seven key IP packet attributes that can be used by NetFlow to classify packets into separate flows:
+ IP source address
+ IP destination address
+ Source port
+ Destination port
+ Layer 3 protocol type
+ Class of Service (or Type of Service – ToS) Byte
+ Input (Router or switch) interface

Other attributes can be also used and they are called non-key attributes such as timestamps, packet and byte counters, TCP flag information…

After inspecting these attributes, the NetFlow Exporter condenses them into flow records and save in a database called the NetFlow cache. These flow records can also be exported to a NetFlow Collector.

How to view NetFlow data

There are two main methods to view NetFlow data:

+ Command Line Interface (CLI): Because the NetFlow cache is a part of the NetFlow Exporter so we can view this cache directly via the Command-Line-Interface (CLI), which is very useful for troubleshooting, with the “show ip cache flow” command. An example output of this command is shown below:

show_ip_cache_flow.jpg

+ A NetFlow reporting tool: there are many tools that can collect NetFlow packets sent to the NetFlow Collector and display a comprehensive view. Below is an example of what SolarWinds NetFlow Traffic Analyzer can analyze:

NetFlow_Reporting_tool.jpg

NetFlow versions

Version 1: the original format supported in the initial NetFlow releases.
Versions 2, 3 and 4 were not released.
Version 5: an enhancement that adds Border Gateway Protocol (BGP) autonomous system information, flow sequence numbers and a few additional fields. This is the standard and most common NetFlow version. Only support IPv4.
Version 6: similar to version 7
Version 7: Cisco-specific version for Catalyst 5000 series switches but not compatible with Cisco routers
Version 8: choice of aggregation schemes in order to reduce resource usage
Version 9: support flow-record format and it is known as Flexible NetFlow technology. NetFlow version 9 includes a template to describe what is being exported. It supports extensible file export format to enable easier support. It also supports additional fields & technologies such as MPLS, IPv6, IPSec, NBAR protocols, Multicast, VLAN ID…

In general, the two most important NetFlow versions are Version 5 and Version 9 which we will learn how to configure them.

Note: NetFlow version 5 only supports monitoring inbound statistics using the “ip flow ingress” command while NetFlow v9 allows to monitor traffic leaving each interface via “ip flow egress” command.

In the next part we will learn how to configure NetFlow version 5 & 9.

Comments (30) Comments
Comment pages
  1. blackyeti
    July 11th, 2016

    Could someone please send ccna dump latest as looking to lock this down. Thanks ahead of time.
    {email not allowed}

  2. blackyeti
    July 11th, 2016

    Could someone please send ccna dump latest as looking to lock this down. Thanks ahead of time.
    1970drake at gmail dot com

  3. Md
    July 13th, 2016

    Hello 9Tut. I am extremely grateful and thankful to your site. The amount of energy you have invested or shall I say gifted here is enormous. Many thanks for your generous contribution. Hope you would keep up the noble work.

  4. vel
    July 19th, 2016

    Clear

  5. Anu
    July 20th, 2016

    Can some send me a latest dump to anushkashanitha@ gmail.com .. Thank you

  6. Anonymous
    July 21st, 2016

    hi everyone, why we cant see the Questions, but just the explanations???.

  7. CJ
    July 24th, 2016

    Can someone please send me the latest dumps for CCNA routing and switching going to take the test mid Aug.

  8. CJ
    July 24th, 2016

    briccboi at yahoo dot com

  9. nic
    July 26th, 2016

    can we do netflow in wireless network

  10. loeuge
    July 27th, 2016

    hello guy please i intend to write CCNA by next week, i need vce simulator that can open recent dumps. Can anyone help??? Please!!!!!!! {email not allowed} is my email

  11. Usman
    July 29th, 2016

    can someone email me VEC file of CCNA Dumps
    {email not allowed}

  12. Ma
    July 29th, 2016

    can someone email me ccna latest dumps at {email not allowed}

  13. cert_push
    July 31st, 2016

    9TUT Amazing tutorials, really appreciate the break down of the different topics. Will be sitting my CCNA middle of august, I feel good about it but would going over some recent questions wouldn’t hurt. So if anyone have the latest dump, message me certpush at gmail dot com. thnx and good luck

  14. Anonymous
    July 31st, 2016

    Hi All, I am taking CCNA exams within 2 weeks. If you have any latest dumps please can you forward to {email not allowed}

  15. Anonymous
    July 31st, 2016

    Hi All, I am taking CCNA exams within 2 weeks. If you have any latest dumps please can you forward to deepansgoudar at gmail dot com

  16. jimwel
    July 31st, 2016

    Hi deepansgoudar! If you have a copy. send it to me also. thanks

  17. Kemal West
    August 1st, 2016

    Thanks

  18. Anonymous
    August 1st, 2016

    Please share latest dumps mbiyu @engineer.com

  19. EMMANUEL
    August 3rd, 2016

    HI ALL, I AM THINKING OF TAKING MY CCNA EXAM NEXT WEEK. CAN ANYONE PLEASE SEND THE LATEST DUMP TO MY EMAIL({email not allowed})

  20. Anonymous
    August 3rd, 2016

    Hi All, I am taking CCNA exams within 2 weeks. If you have a ccna latest dumps please can you forward to my email:{email not allowed}

  21. Anonymous
    August 4th, 2016

    Hey, taking my ccna in a few wks. can anyone pls email me the latest dump, thx?

    briccboi at yahoo dot com

  22. the_dude
    August 4th, 2016

    hello. can someone please send me file for watson 364q. I would greatly appreciate it. Thank you! my email is mikebradley278 @ aol . com

  23. Anonymous
    August 4th, 2016

    Latest dumps to tcarosone at gmail would be appreciated

    Thanks in advance

  24. caesar
    August 6th, 2016

    can smbdy plz send me the dumps lala1444 at live dot com

  25. caesar
    August 6th, 2016

    i have my exam on 11 august

  26. Pemi
    August 7th, 2016

    Hello guys, I have my exams on 15 August please kindly suggest what to revise and i need also dumps for d exam 200-120 …@ this email {email not allowed}

  27. hello
    August 9th, 2016

    i have my exam on 15 august please share the last dump with me i’m {email not allowed}

  28. hello
    August 9th, 2016

    sen me de last dump please i have my exam this week georginarodriguez @ g m a i l . com

  29. hello
    August 9th, 2016

    i have my exam on 15 august please share the last dump with me i’m georginarodriguez1120 @ g m a i l . c o m

  30. Ben
    August 9th, 2016

    Hello guys, please am sitting for ccna on the 11th can i have the recent dumps. much thanks

Comment pages
Add a Comment