About Flexible NetFlow

Cisco IOS Flexible Netflow provides the next level of flexibility and scalability in monitoring network traffic, bringing a new understanding to who is using the network, what applications they are employing, when they are using the applications, and where the traffic originated.

Flexible NetFlow Components

Flexible NetFlow is implemented using flow monitors, the following is a definition of a flow monitor and its components.

Note: A NetFlow flow monitor is a component used to implement Flexible NetFlow and should not be confused with WhatsUp Flow Monitor, which is a NetFlow collector.

Flow monitors. Flow monitors are applied to interfaces to perform network traffic monitoring. These flow monitors consist of the following components:

• Flow records. A record is a combination of key fields, which are used to uniquely define a flow, and nonkey fields, which provide additional information about a flow, but are not used to define the flow. In Flexible NetFlow, both key and nonkey fields can be defined in the record definition, which allows for customized data collection.
• Flow cache. Collects IP data flow records in a router or switch, analyzes this data and prepares the data for export. Flexible Netflow has the capability to track and monitor multiple NetFlow caches, each configured to monitor specific information.
• NetFlow exporter. Exports the data in the flow monitor cache to a remote system, such as Flow Monitor, for analysis and storage. You can create more than one flow exporter, each assigned to one or more NetFlow collectors.
• NetFlow collector. An application that utilizes exported data from one or more NetFlow enabled routers or switches, aggregates and filters the data, then performs real-time visualization and analysis of the recorded and aggregated flow data. The WhatsUp Flow Monitor is an example of a NetFlow collector.

Flexible NetFlow records

Flexible NetFlow can track packet information from Layer 3, as well as some Layer 2 information. The Flexible NetFlow record can be customized to monitor data based on your specific monitoring needs. The information available includes:

• Source and Destination MAC addresses
• Source and Destination IP addresses
• Type of Service
• Differentiated Services Code Point (DSCP)
• Packet and byte counts
• Flow timestamps
• Input and output interface numbers
• TCP flags
• Routing information

Where traditional NetFlow provided a strict definition of which fields in a record are key field, used to define a flow, Flexible NetFlow allows you to define a flow based on the fields and data you want to monitor, which allows for the ability to export only the data needed by the collector to conduct its analysis and reporting. Additionally, there is more data available in Flexible NetFlow than in traditional NetFlow which allows for extensive customization and flexibility in defining flow records.

Flexible NetFlow and Network Based Application Recognition (NBAR)

Through this definition of flows, it is possible to gather information that can be used by Cisco Network Based Application Recognition (NBAR) to identify application data within a flow and provide flow statistics on the application traffic.