Hi Brian,
I used an Internet connection here just to have some interesting traffic to look at.
In this lesson, I used ntop in the screenshots but nowadays you can try ntopng.
Installing ntopng and making it work with netflow can be a pain. There’s a docker image where someone pre-configured ntopng to accept netflow traffic on UDP 2055. I haven’t tested it (yet) but it’s probably much easier than starting from scratch.
Rene
Hello,
When I’m reading Netflow there is a little bit different steps for configuration in other devices…like
1- Create Flow Record
2- Create Flow Exporter
3- Create Flow Monitoring
4- Lastly apply the flow monitor to the interface
Do you think this is based on which cisco devices? I would like to know which devices using which configuration? can you help me?
Thanks,
Samer Abbas
Hello Samer,
That order is correct. I also have a picture that has these steps. You can find it in the performance monitor lesson.
They calls this newer “style” of configuration with the flow record, exporter, and monitor “Flexible” netflow so that’s what you should look for.
They call the older CLI commands “traditional netflow”.
Rene
Hello @lagapidis,
How would you differentiate Netflow and SPAN aka port mirroring?
Hello sales2161
These are two different techniques and technologies that are used for monitoring. They do two different things, but both can be helpful in keeping an eye on the traffic of your network.
SPAN is used to collect copies of packets that are sent and received on particular ports of a network device. You configure SPAN by specifying source ports, that is, the ports that carry the traffic you want to analyze. You also configure a destination port. SPAN essentially reads all packets “seen” on the source ports and dumps them out of the destination port. You must physically connect a PC or other monitoring device on that destination port to receive those packets and store them in an appropriate format. There are various monitoring suites that can be used for this purpose, some providing more general network monitoring such as wireshark, or some others that are more specialized for particular applications such as VoIP. In general, you need a physical connection to one of the switches on your network to do this. SPAN cannot be configured to run remotely over a WAN or over the Internet.
Netflow on the other hand is an application framework that collects what is known as metadata about traffic flows. Unlike SPAN, it doesn’t actually look at the payload of individual packets. Metadata involves information such as top talkers by percentage of traffic, percentage of traffic by protocol, class of service, and the cause of congestion. As its name suggests, it identifies and analyzes flows of traffic rather than collecting individual packets. These flows are analyzed as a whole to come to specific conclusions.
You can find out more about SPAN and its variations at the following lesson:
I hope this has been helpful!
Laz
A post was merged into an existing topic: CCNP Route exam
Hi,
How to configure number of fows per second
Thanks
Hello Sims
Flows are not something that can be configured or changed, but they are events that occur on the network based on the traffic on the network at any one time. Flows are detected, recorded, measured, and monitored, but cannot be influenced directly by NetFlow. They are only influenced by the traffic patterns themselves.
I hope this has been helpful!
Laz
Hi Rene,
Why the commands in the below cisco documents are so much different then in your lesson?
Hello Nitay
Rene’s lesson focuses on the use of the original Netflow (versions 5 and 9). Cisco has since come out with the next generation Netflow which is called Flexible Netflow, which is the version that is being described in the document you shared. Flexible Netflow is a part of Cisco’s new certification curriculum, but Netflow v5 and v9 are also part of the new curriculum, so they are still quite relevant.
I hope this has been helpful!
Laz
Thanks Laz,
I’ve read now that the new “Flexible” Netflow is identical to your explanation about performance monitor’ is that correct?
Hello Nitay
Cisco Performance Monitor is actually an extension of Flexible Netflow. Flexible Netflow alone captures information like source and destination IP addresses and ports. Performance Monitor can also collect additional monitoring information such as jitter, packet loss and round trip time to name a few. You can find out more about Cisco Performance Monitor at the following lesson:
I hope this has been helpful!
Laz
Alright then, shouldn’t FNF be in the syllabus for CCIE LAB / Written exam?
It seems weird that we should know performance monitor but not the FNF itself.
Hello Nitay
What you say makes sense, but according to Cisco’s exam topics for the CCIE, it includes Netflow v5 and v9, as well as Cisco Performance Monitor. Remember, this is for the old curriculum, which will be phased out in February of 2020. In the new syllabus, you will find Netflow v5 and v9 as well as Flexible Netflow in the CCNP level ENARSI exam.
I hope this has been helpful!
Laz
Hello Team
I am able to add another destination in the cisco IOS platform using below commands:
ip flow-export destination x.x.x.201 2055
ip flow-export destination x.x.x.202 2055
But when I do the same IOS XE, the second destination replaces the first. Could you please guide, as in how can we add another destination in the SAME exporter.
This is the format I am using, which doesn’t work:
flow exporter ABC
destination x.x.x.201
destination x.x.x.202Hello Payal
According to the following Cisco documentation for IOS XE:
Each flow exporter supports only one destination. If you want to export the data to multiple destinations, you must configure multiple flow exporters and assign them to the flow monitor.
Note that both IOS and Nexus NX-OS support multiple destinations within the same exporter.
I hope this has been helpful!
Laz
Hello,i find syntax for netflow for 9200 switches different.for some reason i am not seeing the flow in the PRTG.Secondly i am unable to apply monitoring from interfaces.for example
ip flow monitor monitor1 input
would not work in when i applied to gi1/0/3
it reads:
ip flow monitor PRTG-MONITOR input
% Flow Monitor: Failed to add monitor to interface: Unsupported non-key field "interface input"
for ip traffic in Input direction
enter configuration commands, one per line. End with CNTL/Z.
cisco-stack1(config)#vlan configuration 1,30
cisco-stack1(config-vlan-config)#ip flow monitor PRTG-MONITOR input
% Flow Monitor: Flow Monitor 'PRTG-MONITOR' Unsupported non-key field "interface input" for ip traffic in Input direction
Below is my configuration:
flow record PRTG-RTP
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
collect transport tcp flags
collect counter bytes long
collect counter packets long
collect interface input
collect interface output
!
!
flow exporter PRTG_SERVER
destination 192.168.x.x
source Vlan30
transport udp 2055
template data timeout 60
!
!
flow monitor PRTG-MONITOR
exporter PRTG_SERVER
record PRTG-FLOW-RECORD
!
sampler PRTG-SAMPLER
mode random 1 out-of 32
export-protocol netflow-v9
Extended IP access list TCP_TRAFFIC
10 permit tcp any any
when I used the show flow exporter :
cisco-stack1#show flow exporter
Flow Exporter PRTG_SERVER:
Description: User defined
Export protocol: NetFlow Version 9
Transport Configuration:
Destination IP address: 192.168.x.x
Source IP address: 10.20.x.x
Source Interface: Vlan30
Transport Protocol: UDP
Destination Port: 2055
Source Port: 52113
DSCP: 0x0
TTL: 255
Output Features: Used
Export template data timeout
How do i resolve this?
Hello Temitope
It seems that you are applying the flow monitor in an input direction, while at the same time, you have the statement collect interface output in the PRTG-RTP flow record. The input and output directions do not match, and are thus “unsupported”. This error will appear whenever the direction of the flow monitor command doesn’t match with the direction of the match or collect statements in the related flow record.
To resolve this, you must remove the collect interface output statement from the flow record.
Take a look at this Cisco documentation for more details about configuring netflow on the 9200.
I hope this has been helpful!
Laz
Thank you so much.That was very helpful
Hi Rene/Laz,
As we know here we are using one port for sending NetFlow updates and other one to track the flows so my is here as per given topology , will f0/0 be responsible for sending updates for all network flows on router?, and will f0/1 only be responsible for tracking the traffic which is being received on it or others interfaces as well as ?