About Flexible NetFlow

Cisco IOS Flexible NetFlow provides the next level of flexibility and scalability in monitoring network traffic, bringing a new understanding to who is using the network, what applications they are employing, when they are using the applications, and where the traffic originated.

Important: Unlike traditional NetFlow, Flexible NetFlow does not support SNMP. At this time, Flexible NetFlow can only be configured through the CLI. Any tool used to automatically configure NetFlow using SNMP will not work with Flexible NetFlow.

Flexible NetFlow Components

Flexible NetFlow is implemented using flow monitors, the following is a definition of a flow monitor and its components.

Note: A NetFlow flow monitor is a component used to implement Flexible NetFlow and should not be confused with WhatsUp Flow Monitor, which is a NetFlow collector.

• Flow monitors. Flow monitors are applied to interfaces to perform network traffic monitoring. These flow monitors consist of the following components:
• Flow records. A record is a combination of key boxes, used to uniquely define a flow, and nonkey boxes, which are used to provide additional information about a flow, but are not used to define the flow. In Flexible NetFlow, both key and nonkey boxes can be defined in the record definition, which allows for customized data collection.
• Flow cache. Collects IP data flow records in a router or switch, analyzes this data and prepares the data for export. Flexible Netflow tracks and monitors multiple NetFlow caches, each configured to monitor specific information.
• NetFlow exporter. Exports the data in the flow monitor cache to a remote system, such as Flow Monitor, for analysis and storage. You can create more than one flow exporter, each assigned to one or more NetFlow collectors.
• NetFlow collector. An application that utilizes exported data from one or more NetFlow enabled routers or switches, aggregates and filters the data, then performs real-time visualization and analysis of the recorded and aggregated flow data. The WhatsUp Flow Monitor is an example of a NetFlow collector.

Flexible NetFlow records

Flexible NetFlow can track packet information from Layer 3, as well as some Layer 2 information. The Flexible NetFlow record can be customized to monitor data based on your specific monitoring needs. The information available includes:

• Source and Destination MAC addresses
• Source and Destination IP addresses
• Type of Service
• Differentiated Services Code Point (DSCP)
• Packet and byte counts
• Flow timestamps
• Input and output interface numbers
• TCP flags
• Routing information

Where traditional NetFlow provided a strict definition of which boxes in a record are key box, used to define a flow, Flexible NetFlow allows you to define a flow based on the boxes and data you want to monitor, which allows for the ability to export only the data needed by the collector to conduct its analysis and reporting. Additionally, more data is available in Flexible NetFlow than in traditional NetFlow, which allows for extensive customization and flexibility in defining flow records.

Flexible NetFlow and Network Based Application Recognition (NBAR)

Through this definition of flows, it is possible to gather information that can be used by Cisco Network Based Application Recognition (NBAR) to identify application data within a flow and provide flow statistics on the application traffic.

See Also Preparing network devices Determining which network devices to monitor Manually configuring devices to export flow data to Flow Monitor Configuring sFlow enabled devices to export flow data to Flow Monitor About Network Based Application Recognition (NBAR) About CBQoS Viewing potential Flow Monitor sources Using Flow Monitor to Configure Cisco NetFlow Devices