Flexible NetFlow

In the NetFlow lesson, you saw the limits of classic NetFlow: it is not customizable, and you cannot choose which flow characteristics to measure.

Flexible NetFlow was created to provide more precise traffic analysis by allowing administrators to choose exactly what they want to measure.

It enables:

• multiple traffic analyses to run at the same time, and

• the reuse of configuration templates.

On paper, this may sound almost magical! Let’s get started.

Flow Record

The flow record defines what a flow is and which information is collected.
Basically, it is an identity card for traffic.

Figure 1 - Flow Record

A Flow Record is made up of two fields:

• match: identifies the flow (who the flow belongs to)

• collect: gathers statistics related to the flow (what is being measured)

In the example below, the flow named RECORD1 is identified by the IPv4 destination address, and the packet and byte counters are collected.

R1# conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)# flow record RECORD1
R1(config-flow-record)# description IPv4_Destination_Stats
R1(config-flow-record)# match ipv4 destination address
R1(config-flow-record)# collect counter bytes
R1(config-flow-record)# collect counter packets
R1(config-flow-record)# end

This Flow Record tells the router:

“For each IPv4 destination address I see, count how many packets and how many bytes are sent.”

Flow Exporter

The Flow Exporter defines where and how NetFlow statistics are sent.

If the Flow Record tells what to measure,
the Flow Exporter tells where to send the results.

Figure 2 - Flow Exporter

In simple terms, it is the mail carrier that delivers statistics to the collector.

In the configuration of our Flow Exporter, each element defines how to reach the collector.

R1# conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)# flow exporter EXPORT1
R1(config-flow-exporter)# description SEND_TO_COLLECTOR
R1(config-flow-exporter)# destination 192.168.54.100
R1(config-flow-exporter)# export-protocol netflow-v9
R1(config-flow-exporter)# transport UDP 9999
R1(config-flow-exporter)# exit

This Flow Exporter tells the router:

“Send NetFlow statistics to 192.168.54.100,
using NetFlow version 9,
over UDP port 9999.”

The Flow Monitor is the heart of Flexible NetFlow.

To summarize:

• Flow Record → what to measure

• Flow Exporter → where to send

• Flow Monitor → links the two and stores the data

Basically, the Flow Monitor assembles everything and actually enables NetFlow.

Assembling Record and Exporter

Figure 3 - Flow Monitor