Introduction to Cisco NetFlow

(Rene Molenaar) #16

Hi Sims,

You can configure the port that you want to use. In my example I used this:

ip flow-export destination 2055

So you’ll need to permit UDP traffic to port 2055. You can use other port numbers if you want.


1 Like
(sims) #17

Can you explain about netflow vs sflow and how to implement sflow on cisco isr routers ?

(Rene Molenaar) #18

Hi Sims,

Here’s the short version:

NetFlow is used to export IP flows on routers. Since version 9 you can also export L2 traffic. Once you enable NetFlow then you’ll see your CPU load increase a bit.

sFlow is a bit similar to NetFlow but it’s embedded in the ASIC and able to send statistics about L2 up to the application layer.

sFlow is only available on some NX-OS devices at the moment.


(Mr M Y) #19

any chance you can do a tutorial on which ntop package to get and how to configure it on a server (VM)… please!

(Mr M Y) #20

Rene, if we dont use a ntop server, how much flow data can the cisco router store in the cache?

Am looking at running a netflow for 10 days, will all the data for 10 days be available to view on the router itself by doing “show ip cache flow”?

(Rene Molenaar) #21

Hi Mr M Y,

The NetFlow cache in a router is limited. By default, active flows are removed from the cache after 30 minutes.

You might like the information from this Cisco article:

After you enable NetFlow on an interface, NetFlow reserves memory to accommodate a number of entries in the NetFlow cache. Normally, the size of the NetFlow cache meets the needs of your NetFlow traffic rates. The cache default size is 64K flow cache entries. Each cache entry requires 64 bytes of storage. About 4 MB of DRAM are required for a cache with the default number of entries. You can increase or decrease the number of entries maintained in the cache, if required. For environments with a large amount of flow traffic (such as an Internet core router), Cisco recommends a larger value such as 131072 (128K). To obtain information on your flow traffic, use the show ip cache flow command.

A NetFlow cache can be resized depending on the platform and the amount of DRAM on a line card. For example, the NetFlow cache size is configurable for software-based platforms such as Cisco 75xx and 72xx series routers. The amount of memory on a Cisco 12000 line card determines how many flows are possible in the cache.

Using the ip flow-cache entries command, configure the size of your NetFlow cache from 1024 entries to 524,288 entries. Use the cache entries command (after you configure NetFlow aggregation) to configure the size of the NetFlow aggregation cache from 1024 entries to 524,288 entries.

About the NTOP tutorial…it’s best to stick to the “official” tutorials for this. I could create one but it’s probably outdated in a few months when they introduce a newer version.


(Abhishek D) #22

Thanks for a crisp explanation.
However i wanted to understand further usage of Netflow. Can it only be use to monitor traffic pattern or it can be used to increase network performance also.

any example that you can share , will be great.


(Abhishek D) #23

Hello Rene,

I was reading an article about Netflow specific to IOS XE. I read a few terms called :

  1. Netflow Monitor
  2. Flow record
  3. netflow exporter

can you please help in understanding how they are separate from each other ?


(Andrew P) #24

Netflow is used just for information gathering. It does not take action on its own. To do that, you can use a feature called Performance Routing (PfR). PfR actually does use Netflow in something called PfR passive mode to help it make decisions about how to optimize your environment.

If you are interested in learning more about PfR, here is a good introduction

(Abhishek D) #25

Many Thanks Andrew. It clears the doubt.

(sims) #26

Can you post enabling netflow on asa

(Maher H) #27

Hi sims,

I will forward your request to Rene.

I would advise that you can put your ideas for the new lessons here:
In this way, there will be votes so Rene can prepare topics that are more requested than others.

(Diana M) #28

Hello Rene!!

Can you show us how to use the NTOP server?

(Rene Molenaar) #29

Hi Diana,

It’s best to check the NTOP website for this. I used NTOP since it’s open source and available to everyone.

If I would write about NTOP, the information is probably outdated in a few months.


(Shantel - split this topic #30

19 posts were merged into an existing topic: Introduction to Cisco NetFlow

(I Ian L) #31

Hi Gents,

Can netflow be configured on a dialer interface?

(Lazaros Agapides) #32

Hello Ian

Yes, it is possible to configure netflow on a dialer interface. Just keep in mind that whenever you do so, you must also configure netflow on the associated virtual interface as well. This is because the dialer interface will send ONLY outbound traffic to the netflow server while the virtual interface will send ONLY inbound traffic. This is because of the nature of the relationship between dialer and virtual interfaces. According to Cisco:

This is the expected behaviour. Traffic leaves the router via the Dialer interface, as dictated by the IP routing table. Traffic enters the router via the Virtual-Access interface.

This is just the way Cisco has implemented routing via dialer interfaces.

I hope this has been helpful!


(Brian C) #33

I think a typo here see below you say “Can`t” I think you mean “can”??

One of the things we can’t do with those tools is tracking all flows in our network. A flow is a stream of packets that share the same characteristics like source/destination port, source/destination address, protocol, type, service marking, etc.

NM you was talking about SNMP and NBAR not Netflow I see now. my bad.

1 Like
(Chris N) #34

The commands to change this are here if anyone is interested:

Also wondering where flow exporters come into this?

E.g. configuring an exporter, then a monitor, then applying that to an interface.

(Sandeep P) #35

Can we use hostname for netflow configuration on cisco instead of IP.