What is Cisco IOS NetFlow, how it works, History and Evolution, why it is important, Types, Uses, Cisco IOS NetFlow Configurationare all covered in this blog.
What is Cisco IOS NetFlow?
A robust maintenance and monitoring tool included into Cisco IOS software, Cisco IOS NetFlow is intended to gather and examine network traffic data. NetFlow concentrates on traffic statistics, such as packets and bytes, and is able to distinguish between different traffic flows, in contrast to Simple Network Management Protocol (SNMP), which mainly reports on device information.
A flow in NetFlow is defined as a series of packets that share the same characteristics, including:
- IP address of the source
- IP address of the destination
- Port of origin
- The port of destination
- Etiquette
- Interface for input
- Class of Service parameters
As a push-based technology, NetFlow actively transmits gathered flow data to a central repository from the network device on which it is installed.
How it Works?
- Flow Creation and Caching: The router examines incoming traffic, or ingress traffic, when it arrives on a defined router interface. These packets’ IP attribute data is utilised to build a flow. The router then collects and stores this flow data in a local database known as the NetFlow cache or flow cache.
- Flow Termination and Export: Until the flow is stopped (for example, by a connection closing), times out (because of inactivity or an active timer expiring), or the cache fills up, the flow data is kept in the cache. After being discovered, these flows which are normally packaged into 30 to 50 flows are exported, usually via UDP, to a NetFlow Collector server.
- Analysis and Reporting: This exported data is subsequently processed by the NetFlow Collector software to provide reports that are either historical or current. Using the show commands in the command-line interface (CLI), network managers can also see the statistics that have been gathered locally on the router.
Also Read About Hot Standby Router Protocol, How HSRP Works & Applications
History and Evolution
In 1988, the IETF published RFC 1065, which established a standard method for monitoring network devices and contained the initial documentation of the Simple Network Management Protocol (SNMP). The IETF described Cisco IOS NetFlow as a complementary technology through standards such as NetFlow version 9, which forms the foundation of a new IETF standard.
NetFlow has undergone multiple iterations of development:
- It is advised to utilise NetFlow version 1 (v1), which was the original format, only if the analysing program supports it exclusively.
- NetFlow version 5 (v5): The most extensively used version, it exports more fields than v1. The ip flow ingress command was limited to monitoring inward traffic data for NetFlow v5.
- The most recent Cisco IOS NetFlow version, NetFlow version 9 (v9), provides a versatile output format. Using the ip flow egress command to track traffic departing an interface is a new feature of v9.
Why it is Important?
Because NetFlow can give deep visibility into network traffic, it is essential for network operations. Among its benefits and significance are:
- Detailed Traffic Statistics: In contrast to SNMP, NetFlow provides a more detailed perspective of network utilisation by reporting on particular traffic statistics such as packets and bytes per flow.
- Identify and baseline bandwidth-hogging users and programs to optimise network performance.
- In latency-sensitive applications like VoIP, NetFlow data helps troubleshoot bandwidth, latency, and jitter issues.
- Capacity planning and network upgrades benefit greatly from the knowledge that network planning offers regarding users, applications, peak usage periods, and traffic routing.
- Security Monitoring: Administrators can discover and halt threats before they cause serious damage by using NetFlow data to identify unauthorised traffic patterns and possible Denial of Service (DoS) assaults throughout the network.
- Network Traffic Accounting and invoicing: Usage-based traffic accounting and network invoicing are supported.
- Complementary Tool: Rather than taking the place of one another, NetFlow and SNMP operate in tandem to create a powerful toolset for network maintenance and monitoring.
Also Read About Cisco Discovery Protocol, How CDP Works, And Benefits of CDP
Cisco IOS NetFlow Types
Several varieties of NetFlow, a protocol for gathering and examining network traffic statistics, are supported by Cisco IOS. Traditional NetFlow and Flexible NetFlow are the two main varieties.
Traditional NetFlow (Versions 5 and 9)
The early, classic implementations of NetFlow are known as traditional versions. You’ll most likely come across the following versions:
- The most popular and extensively used version of NetFlow is version 5 (v5).Because of its consistent packet format, it always collects the same data. It only supports IPv4 transfers and neither MPLS or IPv6. Despite being straightforward and effective, its rigid format restricts its applicability in intricate, contemporary networks.
- A significant improvement was made with NetFlow Version 9 (v9): a template-based format. v9 defines what data to capture using templates rather than a set format. It is far more expandable and flexible as a result. One of its main advantages is that it supports IPv4, IPv6, MPLS, and other protocols. It also lets you set custom fields to gather. The IETF standard for flow data export, IPFIX, is based on this version.
Flexible NetFlow (FNF)
The next-generation NetFlow in Cisco IOS, known as Flexible NetFlow (FNF), is thought to be a major advancement over NetFlow. It expands upon NetFlow v9’s template-based architecture to offer even more precise control.
Three primary components make up the modular architecture upon which FNF is based:
- The foundation of FNF is the flow record. It specifies the information to be gathered. To specify precisely the fields you wish to monitor, including source/destination IP, ports, protocol, and even application-specific data, you can use match and collect commands to construct custom flow records.
- The flow record is applied to a particular interface or sub-interface by the Flow Monitor component. It controls how long flows are stored in the cache before being exported and maintains the flow cache.
- Flow Exporter: This part specifies the location and method of sending gathered flow data to a NetFlow collector. It indicates the UDP port, the destination IP address, and the NetFlow protocol version to be used (usually NetFlow v9).
- FNF is the recommended approach for contemporary network traffic analysis, security monitoring, and capacity planning since it provides more customisation, scalability, and efficiency.
Also Read About Network Device Monitoring: Control Plane & Protocol Insights
Uses
For network administrators and operations personnel, Cisco IOS NetFlow offers a variety of uses:
- Monitoring data utilization for various users, departments, or applications is known as network traffic accounting.
- Billing clients or internal departments according to their network usage is known as usage-based network billing.
- Network Planning: Choosing wisely when allocating resources and upgrading networks.
- Security monitoring: identifying irregularities, illegal traffic, and denial-of-service assaults.
- Troubleshooting: Finding jitter, latency, and performance snags, especially with VoIP.
- Knowing which apps are being utilised, by whom, and when is known as application monitoring.
- Understanding how traffic moves through the network is possible through traffic routing analysis.
Cisco NetFlow Configuration
There are three main processes involved in configuring Cisco IOS NetFlow:
Set up the interface such that flows are recorded in the NetFlow cache
The process is carried out for each interface from which you wish to collect data.
- To enable flow capture for incoming traffic on an interface, use the ip flow ingress command.
- IP flow egress is another tool for monitoring outgoing traffic in NetFlow v9.
- In the past, flows on a physical interface and all related subinterfaces were enabled using the ip route-cache flow command. IP flow ingress has taken its place in more recent IOS releases (such as 12.2(2)T and 12.2(18)SXD), yet both may show up in show running-config if set up.
Set up the version or format of Cisco IOS NetFlow
- This command is for global configuration.
- The export version (1, 5, or 9) is specified. The most recent and adaptable standard is Version 9, whereas Version 5 is still extensively used.
Set up and define the IP address and UDP port of the NetFlow Collector
- Another global configuration command is this one.
- The router is instructed where to send the gathered flow data by this command. Usually, UDP is used to convey the data.
- NetFlow data is sent to 150.1.1.254 over UDP port 5000.
Verification
- Display local device statistics before or after export with show ip cache flow.
- The NetFlow Collector’s application reporting tool allows users to view and analyse the data once it has been exported.
Additional Information
- In routers and other devices, NetFlow enables the CPU to initially fill a forwarding information base (FIB), also known as a route cache. This is a component of Cisco Express Forwarding (CEF), a proprietary switching mechanism driven by topology that reduces the performance cost of process-switched lookups and speeds up packet forwarding. The routing table (control plane) and CEF’s forwarding table are connected.
- The traffic statistics-related show ip interface command with mac-accounting or mpls-exp arguments can display interface MAC accounting information or MPLS experimental accounting information, respectively.
- External NetFlow Collector servers, which transform the raw flow data into helpful graphs and tables, can be integrated with Cisco IOS NetFlow.
Also Read About Network Device Management Software: Centralized Control