Introduction to Cisco NetFlow

Can we use hostname for netflow configuration on cisco instead of IP.

Hello Sandeep

Looking at several of the Cisco commands for Netflow, it does look like you can use the hostname instead of the IP address. Take a look at this command reference documentation for Netflow on Cisco which includes either IP address or hostname for most commands.

I hope this has been helpful!

Laz

Hello Chris

Flow exporters are used to export Flexible NetFlow data to remote systems such as a UNIX server running NetFlow collector. You can find out more about them at this Cisco documentation which includes prerequisites, restrictions and additional information.

I hope this has been helpful!

Laz

Hi Laz,

Just wondering in which circumstances you would use an exporter and which one to use this lesson’s methods.

Both appear to do the same thing - export data to an external server.

You can also configure Flow Records, Flow Monitors (link record to the monitor), and then apply the flow monitors to the interface.

Hi Chris,

The commands I used in this lesson are a quick way to get netflow up and running and export everything. The exporter is better to use in production.

You can create a different exporter for different traffic types and use different settings per exporter.

Rene

I see you have PC is it suppose to reach the internet? I setup this lab in GNS3 then added NAT and had to change one interface to ip address dhcp. then my router could get to the internet but the PC could not. In order for my inside network to reach the internet I would need to setup NAT on my R1 router as well. in order for this lab to work do we need to have that internet access or was the other items just kind of for looks but really didn’t need to reach internet?

This does not seem to be working for me hmm I added an application called ntopng which I thought was the same app. Here is my topology:

Capture

I then ran the commands but didnt seem to get all the information as you did.

Capture

basically my config is below though I need to change something as my firefox browser is not getting to the internet and I cannot poing 8.8.8.8 for the linux command prompt… I had not really focused on that as I was messing with the netflow.

hostname R1
!
interface FastEthernet0/0
 ip address 192.168.1.254 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
interface FastEthernet0/1
 ip address dhcp
 ip flow ingress
 ip nat outside
!
ip flow-export source FastEthernet0/0
ip flow-export version 9
ip flow-export destination 192.18.1.1 2055
!
ip nat inside source list 1 interface FastEthernet0/0 overload
!
access-list 1 permit any
!
end

when I looked at the ntopping website it said no traffic… :*(

Capture

Hi Brian,

I used an Internet connection here just to have some interesting traffic to look at.

In this lesson, I used ntop in the screenshots but nowadays you can try ntopng.

Installing ntopng and making it work with netflow can be a pain. There’s a docker image where someone pre-configured ntopng to accept netflow traffic on UDP 2055. I haven’t tested it (yet) but it’s probably much easier than starting from scratch.

Rene

Hello,

When I’m reading Netflow there is a little bit different steps for configuration in other devices…like

1- Create Flow Record
2- Create Flow Exporter
3- Create Flow Monitoring
4- Lastly apply the flow monitor to the interface

Do you think this is based on which cisco devices? I would like to know which devices using which configuration? can you help me?

Thanks,
Samer Abbas

Hello Samer,

That order is correct. I also have a picture that has these steps. You can find it in the performance monitor lesson.

They calls this newer “style” of configuration with the flow record, exporter, and monitor “Flexible” netflow so that’s what you should look for.

They call the older CLI commands “traditional netflow”.

Rene

1 Like

Hello @lagapides,

How would you differentiate Netflow and SPAN aka port mirroring?

1 Like

Hello sales2161

These are two different techniques and technologies that are used for monitoring. They do two different things, but both can be helpful in keeping an eye on the traffic of your network.

SPAN is used to collect copies of packets that are sent and received on particular ports of a network device. You configure SPAN by specifying source ports, that is, the ports that carry the traffic you want to analyze. You also configure a destination port. SPAN essentially reads all packets “seen” on the source ports and dumps them out of the destination port. You must physically connect a PC or other monitoring device on that destination port to receive those packets and store them in an appropriate format. There are various monitoring suites that can be used for this purpose, some providing more general network monitoring such as wireshark, or some others that are more specialized for particular applications such as VoIP. In general, you need a physical connection to one of the switches on your network to do this. SPAN cannot be configured to run remotely over a WAN or over the Internet.

Netflow on the other hand is an application framework that collects what is known as metadata about traffic flows. Unlike SPAN, it doesn’t actually look at the payload of individual packets. Metadata involves information such as top talkers by percentage of traffic, percentage of traffic by protocol, class of service, and the cause of congestion. As its name suggests, it identifies and analyzes flows of traffic rather than collecting individual packets. These flows are analyzed as a whole to come to specific conclusions.

You can find out more about SPAN and its variations at the following lesson:

I hope this has been helpful!

Laz

1 Like

A post was merged into an existing topic: CCNP Route exam

Hi,
How to configure number of fows per second
Thanks

Hello Sims

Flows are not something that can be configured or changed, but they are events that occur on the network based on the traffic on the network at any one time. Flows are detected, recorded, measured, and monitored, but cannot be influenced directly by NetFlow. They are only influenced by the traffic patterns themselves.

I hope this has been helpful!

Laz

Hi Rene,
Why the commands in the below cisco documents are so much different then in your lesson?

1 Like

Hello Nitay

Rene’s lesson focuses on the use of the original Netflow (versions 5 and 9). Cisco has since come out with the next generation Netflow which is called Flexible Netflow, which is the version that is being described in the document you shared. Flexible Netflow is a part of Cisco’s new certification curriculum, but Netflow v5 and v9 are also part of the new curriculum, so they are still quite relevant.

I hope this has been helpful!

Laz

1 Like

Thanks Laz,
I’ve read now that the new “Flexible” Netflow is identical to your explanation about performance monitor’ is that correct?

1 Like

Hello Nitay

Cisco Performance Monitor is actually an extension of Flexible Netflow. Flexible Netflow alone captures information like source and destination IP addresses and ports. Performance Monitor can also collect additional monitoring information such as jitter, packet loss and round trip time to name a few. You can find out more about Cisco Performance Monitor at the following lesson:

I hope this has been helpful!

Laz

1 Like

Alright then, shouldn’t FNF be in the syllabus for CCIE LAB / Written exam?
It seems weird that we should know performance monitor but not the FNF itself.

Hello Nitay

What you say makes sense, but according to Cisco’s exam topics for the CCIE, it includes Netflow v5 and v9, as well as Cisco Performance Monitor. Remember, this is for the old curriculum, which will be phased out in February of 2020. In the new syllabus, you will find Netflow v5 and v9 as well as Flexible Netflow in the CCNP level ENARSI exam.

I hope this has been helpful!

Laz

1 Like