Niall McMahon

Search by DuckDuckGo

Getting Started with Netflow

2022-07-21

Some notes about getting started with Cisco Netflow.

Netflow

Overview

NetFlow is a feature that was introduced on Cisco routers in the mid-1990s.

Routers and switches that are Netflow enabled can collect IP traffic statistics about interfaces. This Netflow data is forwarded as soon as its generated to a Netflow collector, usually a server running analysis code.

Version 5 is supported across the Cisco router range. In addition, Version 5 uses bandwidth the most efficiently of all Netflow versions.

Flows

A flow is a sequence of similar network packets all going in the same direction. Packets in a flow are similar in that the values for seven important packet descriptors are the same. The seven descriptors make up a tuple - a list of the seven descriptors - that identifies the flow.

The seven descriptors are: (i) the ingress interface, i.e. the SNMP ifIndex, (ii) the source IP address, (iii) the destination IP address, (iv) the IP protocol, (v) the source port for UDP or TCP, or 0 for other protocols, (vi) the destination port for UDP or TCP. Type and code for ICMP and 0 for other protocols, (vii) the IP Type of Service. This is the second byte of the IPV4 header.

IBM has detail on the Version 5 data formats.

Packet Tracer

Cisco's free Packet Tracer software allows you to create a simulated network and to experiment with configuring infrastructure devices (routers, switches etc.) for Netflow logging. You can learn how to set up a Netflow generator that will export Netflow to a collector. This is super.

There are limitations:

Still, Packet Tracer allows you to understand how to set up a network and to get a Netflow collection system working.

Netflow Generator

Netflow Collector

Datasets

Netflow datasets for testing:

References