GigaSMART NetFlow Generation
Required License: NetFlow Generation
Required License for NetFlow with Second Level Maps: Adaptive Packet Filtering (APF)
NetFlow Generation is a simple and effective way to increase visibility into traffic flows and usage patterns across systems. The flow-generated data can be used to build relationships and usage patterns between nodes on the network. Routers and switches that support NetFlow can collect IP traffic statistics to be exported as NetFlow records.
However, the processor and memory load of enabling NetFlow can cause service degradation and affect their ability to pass traffic without introducing latency and packet drops. Due to this processing overhead, sampled NetFlow is implemented in most of the high-end routers. Sampling in every “N” packets for NetFlow processing can severely limit the visibility needed to monitor flows.
The advanced capabilities of GigaSMART® technology can be leveraged to summarize and generate unsampled NetFlow statistics from incoming traffic streams. Offloading NetFlow Generation to an out-of-band solution like the Gigamon Visibility Platform completely eliminates the risk of using core production network resources in generating this data. Combined with the flexibility offered by Gigamon’s patented Flow Mapping®® technology, operators can pick and choose from which flows to generate NetFlow statistics, while at the same time sending the original packets to other monitoring tools.
Support for NetFlow versions 5 and 9 and IP Information Export (IPFIX), as well as CEF, enables seamless integration with standards-based collectors. NetFlow records can also be exported to multiple collectors concurrently, providing a single flow source for business-critical management applications such as security, billing, and capacity planning. Exported flows can also be filtered so that collectors only receive the specific records relevant to them.
Note: Legacy NetFlow supports only one NetFlow version (v5,v9, or IPFIX) record and NetFlow exporter format version per engine unless the exporter format is CEF.
Gigamon has also extended IPFIX to include URL information, providing insight into HTTP and SIP traffic. Other enterprise extensions for IPFIX are HTTP, DNS, and SSL certificates, which provide metadata that can be used for security analysis.
Additionally, Gigamon’s Visibility Platform architecture is the first in the industry to summarize flow statistics as well as to provide the flexibility of aggregating, replicating, filtering, and forwarding raw traffic streams to monitoring tools for detailed troubleshooting and analytics.
The Gigamon Visibility Platform establishes a scalable framework to deliver pervasive flow-level visibility across enterprises, data centers, and service provider environments to accurately design, engineer, optimize, and manage their network infrastructure.
Note: NetFlow Generation exports records using IPv4. IPv6 is not supported.
GigaSMART operations with a NetFlow component can be assigned to multiple GigaSMART groups or GigaSMART groups consisting of multiple GigaSMART engine ports.
NetFlow/IPFIX Generation is a pillar of the GigaSECURE Security Delivery Platform.
NetFlow Generation is displayed in Figure 1: NetFlow Generation Gigamon Solution.
Figure 63 | NetFlow Generation Gigamon Solution |
In Figure 1: NetFlow Generation Gigamon Solution, incoming packets from network(s) enter the Gigamon Visibility Platform and are directed by maps to NetFlow. NetFlow examines the incoming packets and converts the packets of choice into flows records. Specific flows are then forwarded to specific tools, such as Security, Application Performance, and Customer Experience Management (CEM) tools.
NetFlow Generation Components
NetFlow Generation collects IP traffic statistics on all interfaces where a NetFlow Monitor is enabled. It then gathers the statistics of the traffic flows and exports the NetFlow records to at least one NetFlow collector (typically a device that performs the actual traffic analysis based on the information from the NetFlow records).
Figure 2: NetFlow Generation Components shows the NetFlow Generation components.
Figure 64 | NetFlow Generation Components |
: illustrates the NetFlow Generation and how its components are associated. The NetFlow Generation associates its components in the following order:
1. | One or more Records are associated to the Monitor. |
2. | The Monitor is associated to the GigaSMART group. |
3. | The Exporter is associated to the IP interface with tool port. |
4. | The map will eventually bind to the Exporter, Record, and Monitor. |
Note: The dotted line from the map represents the interaction between the NetFlow Generation components.
Refer to Example 1: NetFlow Generation Configuration on page 631 for an example configuration of the following components.
Network Ports
NetFlow operates on the network flow. The incoming traffic on the network ports contains inputs such as, source and destination IP addresses, source and destination ports, interfaces, and so on. The network ports provide traffic to maps.
Map(s)
Traffic is received and acted upon according to maps. Maps determine what traffic is forwarded to NetFlow. Through map configuration, you add rules to filter the packets that need to go to NetFlow, and associate the map to the IP interface with tool port to specify where to send the filtered traffic.
Starting in software version 4.3.01, NetFlow supports both first level and second level maps. First level maps contain flow mapping rules to filter traffic that is needed by NetFlow and then send the filtered traffic to the IP interface with tool ports.
Second level maps are used for configuring filtering rules enabled through Adaptive Packet Filtering (APF). A virtual port is configured that directs traffic to the second level map. After the APF rules are applied, the filtered traffic that is needed by NetFlow is sent to the IP interface tool ports.
For examples of first level maps, refer to Example 1: NetFlow Generation Configuration and Example 2: NetFlow Generation Configuration.
For examples of first and second level maps, refer to Example 3: NetFlow Generation Configuration and Example 4: NetFlow Generation Configuration.
GigaSMART Group
The GigaSMART group specifies the GigaSMART engine to use, such as 8/1/e1 or
8/1/e2.
GSOP
The GigaSMART operation enables NetFlow. If a second level map is configured, the GigaSMART operation directs traffic to APF first, and then to NetFlow.
NetFlow Records
A NetFlow record contains key elements that specify what to match in the flow, such as all packets with the same source and destination port, or anything that comes in on a particular interface. A flow record also contains non-key elements that specify what information to collect for the flow, such as when the flow started or the number of bytes in the flow.
For NetFlow-v5, the fields in the flow record are fixed. For details, refer to V5 Fixed Record Template on page 657.
For NetFlow-v9 and IPFIX, you configure the fields, and thus create a record template. You specify how the fields are organized and in what order. The template is sent to the collector, so the collector knows what fields to expect in a NetFlow record. The template is sent periodically.
Starting in software version 4.6, multiple records are supported. An increased number of records allows more NetFlow data to be exported.
The maximum number of records is five. For all five records, each record must have the same match fields but differing collect fields. The same match fields will define the flows being considered. The different collect fields will define multiple templates sent to the NetFlow servers.
Starting in software version 5.1 for IPFIX and software version 5.2 for v5 and v9, a mix of IPv4 and IPv6 collect fields (IPv4 source/destination and IPv6 source/destination) are not supported in one record. Instead, create two records, one for IPv4 collect fields and one for IPv6 collect fields. When the IPv4/IPv6 collect fields are in separate records, an exporter will only send out records with non-blank elements.
NetFlow Monitors
Monitors store the NetFlow records associated with them. The configuration of a monitor includes the definition of the cache that specifies the records that you want to store, as well as timeouts associated with the cache. The cache can contain up to 4 million entries.
There can be a maximum of two monitors on a GigaSMART line card or module, one associated with each e port.
Starting in software version 4.6, up to five records can be added to the monitor. This results in the creation of five templates. For all five records, each record must have the same match fields but differing collect fields.
Sampled NetFlow Data
NetFlow data can be sampled. Sampling reduces the amount of ingress traffic sent to NetFlow for processing, which reduces the load on external collectors.
A NetFlow monitor can have multiple records with different sampling rates. The records are only updated with packets at the rate specified.
The following types of sampling are available: single-rate or multi-rate, as well as no sampling.
Sampling is enabled and disabled on the NetFlow monitor, across all flows. When sampling is enabled, you define the sampling rate by specifying a number for 1 in N, where N is the packet count.
For single-rate, the number can be from 10 to 16000. For multi-rate, the number can be from 1 to 16000. Single-rate applies to all records, whereas multi-rate applies to any record.
Note: In a single-rate sampling type, all the NetFlow records are sampled in the same rate. In multi-rate sampling type, the sampling rate of the NetFlow records differ according to the settings defined in the individual records.
For example, if sampling is 1 in 1024, 1 packet in 1024 will be selected for NetFlow. The default is 1 in 1, which means no sampling.
NetFlow Exporters
NetFlow records are sent to exporters. Each exporter is associated with one external collector. Records can be exported to both IPv4 and IPv6 destination. Either IPv4 or IPv6 destination address can be configured in an exporter. There can be up to six exporters that send flow records to up to six external collectors. The six destinations are per GigaSMART engine.
The configuration of an exporter includes the IP address of a collector, the transport protocol and destination port, and the template refresh interval, which specifies the frequency of when the record template is sent to the collector.
Starting in software version 5.1, an option is added to assign different exporters to different records. Instead of records being sent to all exporters, you can add an exporter to a record, which defines the exporter to which the record is sent.
IP Interface with Tool Ports
NetFlow exporters are associated with IP interface, since exporters route both records and templates to collectors in the network.
Note: It is expected that the gateway specified in the IP interface configuration does Layer 3 routing. However, when the IP interface and the collector’s IP address are in the same subnet, the following applies:
• | Configure the IP interface’s gateway IP address to the same as the collector’s IP address. |
• | Configure the IP interface’s subnet mask. |
• | The maximum number of exporters supported per GigaSMART group is six. |
Enhancements to NetFlow
In addition to the NetFlow components, there are also the following enhancements:
• | Exporter Filtering |
• | Remote Interface IDs |
• | NetFlow Option Templates |
• | IPFIX Extension: HTTP Response Code |
• | IPFIX Extension: Packet URL |
• | IPFIX Extension: User Agent |
• | IPFIX Extension: Domain Name Service (DNS) |
• | IPFIX Extension: SSL Metadata |
• | SNMP Packet Support on IP Interfaces with Tool Ports |
• | NetFlow Format Support on Exporters |
Configure NetFlow Generation
The following are the step for setting up a typical NetFlow Generation configuration with H-VUE:
• | Step 1: Configure a GigaSMART Group |
• | Step 2: Configure the NetFlow Exporter |
• | Step 3: Configure an IP Interface |
• | Step 4: Configure the NetFlow Record |
• | Step 5: Configure the NetFlow Monitor |
• | Step 6: Add the NetFlow Monitor to GigaSMART Group |
• | Step 7: Configure the GigaSMART Operation |
• | Step 8: Configure Mapping Rules to Filter Packets |
Step 1: Configure a GigaSMART Group
Configure a GigaSMART Group using the following steps. you will use this GigaSMART Group in Step 6: Add the NetFlow Monitor to GigaSMART Group, where you assign a NetFlow Monitor to the group.
1. | From the device view, select GigaSMART > GigaSMART Groups. |
2. | Click New to create a new GigaSMART Group or select an existing GigaSMART Group and click Edit. |
3. | Enter an alias to help identify this GigaSMART group. For example, Netflow-gsgrp |
4. | Select an engine port (the e port references the GigaSMART line card or module) Your GigaSMART group should look similar to the example shown in the following figure. |
5. | Click Save. |
Notes:
• | The GigaSMART Group can contain multiple GigaSMART engine ports. |
• | Only one NetFlow Generation Monitor can be configured per GigaSMART Group. |
Step 2: Configure the NetFlow Exporter
Configure one or more NetFlow Generation Exporters. There can be up to six NetFlow Generation Exporters for each NetFlow Generation Monitor.
To access GigaSMART within GigaVUE-FM, access a device that has been added to GigaVUE-FM from the GigaVUE-FM interface. GigaSMART appears in the navigation pane of the device view on supported devices. Refer to the Access GigaSMART from GigaVUE-FM for details.
To configure the NetFlow Exporter, do the following:
1. | From the device view, select GigaSMART > NetFlow / IPFIX Generation > Exporters. |
2. | Click New. The NetFlow Exporters page appears. |
3. | On the NetFlow Exporter page, enter the information for the exporter. Table 2: NetFlow ExporterConfiguration Fields describes the fields. |
Note: The NetFlow version must be configured with the same version of the Exporter and the Record. If no version is specified, version 9 is the default.
4. | Under the Filters section, click Add a Rule to create a filter for the exporter. |
5. | Click Save. |
Field |
Description |
Alias |
The alias name for the NetFlow Exporter. |
Description |
An optional description of the NetFlow record. |
Format |
The format is either NetFlow or CEF. |
Version |
The version is either NetFlow-v9, NetFlow-v5, or IPFIX. |
Template Refresh Interval |
After each template-refresh-interval, the record template is sent to the collector. Also, the option template is sent. |
SNMP |
Enables SNMP packet support on IP interfaces associated with the NetFlow Exporter. |
Transport Protocol |
The UDP port of the collector. This value cannot be changed. |
IP Version |
IP Version of the destination IP. You can select IPv4 or IPv6. Default is set as v4. |
Destination IP |
The IP address of the NetFlow/IPFIX collector. Default is set as 0.0.0.0. |
Destination Port |
Port for the destination IP. Default is set as 2055. |
DSCP |
The DSCP priority of the packet. Default is set as 0. |
TTL |
The Time to Live of the packet. Default is set as 64. |
Step 3: Configure an IP Interface
In this step, you identify the collector port and configure it as a tool port, where the NetFlow collector will be connected, and then configure an IP interface. The steps are as follows:
1. | Select the port to use and configure it as a tool port. |
a. | Select Ports > Ports > All Ports. |
b. | Click the Quick Port Editor button to open the Quick Port Editor. |
c. | In the Quick Port Editor select the port to use for the IP interface, provide an alias to help identify the port (for example, NetFlow_Tunnel_Port), select Tool for the port type, and select Enable. |
d. | Click OK. |
2. | Select Ports > IP Interfaces. |
3. | Click New. |
4. | On the IP Interface page, do the following: |
a. | In the Alias and Comment fields, enter a name and description for the IP interface. |
b. | From the Port drop-down list, select the tool port that you configured in Step 1. |
c. | Select the type of IP interface as either IPv4 or IPv6. |
d. | Enter the IP Address, IP Mask, Gateway address, and MTU value. |
e. | From the GigaSMART Group drop-down list, select the GigaSMART group you created in Step 1: Configure a GigaSMART Group. |
f. | From the Exporters drop-down list, select the NetFlow exporter you created in Step 2: Configure the NetFlow Exporter. |
Step 4: Configure the NetFlow Record
Configure a NetFlow Generation Record that has the following:
• | match parameters that identify unique flows |
• | collect parameters that identify fields you want to collect for the unique flows |
To access GigaSMART within GigaVUE-FM, access a device that has been added to GigaVUE-FM from the GigaVUE-FM interface. GigaSMART appears in the navigation pane of the device view on supported devices. Refer to the Access GigaSMART from GigaVUE-FM for details.
To configure the NetFlow Record, do the following:
1. | From the device view, select GigaSMART > NetFlow / IPFIX Generation > Records. |
2. | Click New. The NetFlow record page shown in Figure 7: NetFlow Record Page displays. |
Figure 69 | NetFlow Record Page |
3. | On the NetFlow Record page, do the following: |
a. | Specify the NetFlow Record information: |
• | Enter an alias to help identify the record |
• | Enter a Description (optional) |
• | Enter the Sampling Rate that you want |
• | Select the Exporter that you want from the Exporters menu |
• | Select the Version |
The Version is either NetFlow-v9 or IPFIX. The NetFlow version must be configured with the same version of the Exporter and the Record. NetFlow-v9 is the default.
The Sampling Rate is multi-rate only, and is specified as 1 in N, where N is the packet count. The packet count can be a number from 1 to 16000. Refer to Sampled NetFlow Data. The Sampling Rate is disabled by default.
NetFlow-v9 and IPFIX let you configure Match/Key and Collect/Non-Key elements.
Make sure that you configure the NetFlow version prior to configuring the match and collect parameters because the subsequent parameters depend on the NetFlow version configured.
b. | Specify the Configuration: |
Key Fields (Match) — the parameters that identify unique flows. The available Match/Key fields are based on the configured NetFlow version
Non-Key Fields (Collect) — the parameters that identify what you want to collect for the unique flows. The number of Collect/Non-Key elements in a record can be up to 32.
For details about the match and collect parameters, refer to NetFlow Generation Match/Key and Collect/Non-Key Elements
Step 5: Configure the NetFlow Monitor
Configure a NetFlow Generation Monitor and associate the NetFlow Generation Record to the specified NetFlow Generation Monitor by doing the following:
1. | From the device view, select GigaSMART > NetFlow / IPFIX Generation > Monitors. |
2. | Click New. The Monitors page displays. |
3. | On the Monitors page, do the following: |
a. | Enter an Alias to identify the monitor. |
b. | Enter a Description (optional). |
c. | Configure the Cache parameters. Refer to Table 3: NetFlow Monitor Parameters. |
d. | Configure the Sampling parameters. Refer to Table 3: NetFlow Monitor Parameters. |
e. | Select the Record that you configured in Step 4: Configure the NetFlow Record. |
4. | Click Save. |
Parameter |
Description |
|||||||||
Cache Type |
Set as Normal. |
|||||||||
Cache Timeout Active |
Despite the flow being active, it is “flushed out” to the Exporter after this timeout, which is set in seconds. |
|||||||||
Cache Timeout Inactive |
Inactive flows are “flushed out” to the Exporter after this timeout, which is set in seconds. |
|||||||||
Cache Timeout Event |
Applies to the TCP flow. The flow is “flushed out” to the Exporter after detecting a FIN or RST. |
|||||||||
Mode |
Select the sampling mode that you want:
|
|||||||||
Single Sampling Rate |
Refer to Sampled NetFlow Data. |
Step 6: Add the NetFlow Monitor to GigaSMART Group
Return to the GigaSMART Group configured in Step 1: Configure a GigaSMART Groupand set the NetFlow Monitor to the monitor created in Step 2: Configure the NetFlow Exporter.
1. | From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups. |
2. | Select the GigaSMART Group configured in Step 1: Configure a GigaSMART Group, and then click Edit. |
3. | Under GigaSMART Parameters, go to NetFlow. Click in the Monitor field and select the NetFlow monitor configured in Step 5: Configure the NetFlow Monitor as shown in the following figure. |
4. | Click Save. |
Step 7: Configure the GigaSMART Operation
Define a GigaSMART operation to enable NetFlow Generation. If combining NetFlow with APF or Deduplication GSOPs, make sure that you select both operations when creating the GigaSMART Operation.
To access GigaSMART within GigaVUE-FM, access a device that has been added to GigaVUE-FM from the GigaVUE-FM interface. GigaSMART appears in the navigation pane of the device view on supported devices. Refer to the Access GigaSMART from GigaVUE-FM for details.
To configure the GigaSMART Operation, do the following:
1. | From the device view, select GigaSMART > GigaSMART Operations (GSOP). |
2. | Click New. The GigaSMART Operations (GSOP) page displays. (Refer to Figure 8: GigaSMART Operation (GSOP) Page.) |
3. | On the GigaSMART Operations page, do the following: |
a. | In the Alias field, enter a alias to help identify this gsop. |
b. | In the GigaSMART Groups field, select the gsop configured in Step 1: Configure a GigaSMART Group. |
dIn the GigaSMART Operations (GSOP) field, select NetFlow. The NetFlow GigaSMART Operation is enabled by default as shown in Figure 8: GigaSMART Operation (GSOP) Page.
Figure 70 | GigaSMART Operation (GSOP) Page |
4. | Click Save. |
Step 8: Configure Mapping Rules to Filter Packets
To add flow mapping rules to filter packets that are needed to run NetFlow, configure a map and associate the map to the IP interface with tool port.
For more detailed information about flow mapping, refer to About Flow Mapping® and Manage Maps.
Notes:
• | For a single NetFlow GigaSMART Operation, make sure that you create a Regular By Rule map. When combining with APF or Deduplication, use First Level or Single Level map types. |
• | Make sure that the other combining GigaSMART Operations are configured before creating maps using NetFlow. |
• | When combining NetFlow with APF or Deduplication, create virtual ports to use with the second level maps. |
• | The destination tool port must be the IP interface with tool port identified in Step 3: Configure an IP Interface |
For second level maps, you will need to create virtual ports. To create virtual ports, do the following:
1. | From the device view, select GigaSMART > Virtual Ports. |
2. | Click New. The Virtual Ports page displays. |
3. | Enter an alias in the Alias field to identify the virtual port. |
4. | In the GigaSMART Groups field, select the GigaSMART Group configured in Step 1: Configure a GigaSMART Group. |
5. | Click Save. |
To configure mapping rules to filter packets, do the following:
1. | Select Maps > Maps > Maps. |
2. | Click New to create a new map. |
3. | On the New Map page, do the following: |
a. | Enter an alias in the Alias field and select the map Type and Subtype. |
b. | Specify Source and Destination ports. |
c. | In the GigaSMART Operations (GSOP) field, select the GigaSMART Operation configured in Step 7: Configure the GigaSMART Operation. |
d. | Click Add a Rule to add the rules needed for the map. |
4. | Click Save. |
Configure NetFlow Generation Examples
The following sections provide examples of NetFlow Generation.
• | Example 1: NetFlow Generation Configuration |
• | Example 2: NetFlow Generation Configuration |
• | Example 3: NetFlow Generation Configuration |
• | Example 4: NetFlow Generation Configuration |
Example 1: NetFlow Generation Configuration
In Example 1, the steps set up a typical NetFlow Generation configuration.
Ex 1, Step 1: Configure the GigaSMART Group
Configure a GigaSMART group and associate it with a GigaSMART engine port.
Step |
Description |
UI Steps |
||||||||||||||||||
|
Configure the GigaSMART Group |
|
||||||||||||||||||
|
Display the information about the GigaSMART Group. |
|
Ex 1, Step 2: Configure the NetFlow Generation Exporter
Configure one or more NetFlow Generation Exporters. There can be up to 6 NetFlow Generation Exporters for each NetFlow Generation Monitor.
The following parameters apply to this example:
• | Transport Protocol — the UDP port of the collector. |
• | Version — the version is either NetFlow-v9 or IPFIX. The NetFlow version must be configured with the same version of the Exporter and the Record. If no version is specified, version 9 is the default. |
• | Template Refresh Interval — after each template-refresh-interval, the record template is sent to the collector. Also, the option template is sent. |
• | SNMP — enables SNMP packet support for the NetFlow exporter. |
• | Destination IP — the IP address of the NetFlow/IPFIX collector. |
• | DSCP — the DSCP priority of the packet. |
• | TTL — the Time to Live of the packet. |
Step |
Description |
UI Steps |
|||||||||||||||||||||
|
Configure the exporter. The exporter (exp4) will be used in Ex 1, Step 8: Configure Mapping Rules to Filter Packets. |
Alias: exp4. Version: IPFIX Template Refresh Interval: 60
Transport Protocol: UDP IP Version: v4 Destination IP: 20.20.20.20 Destination Port: 2055 DSCP: 10 TTL: 64
|
|||||||||||||||||||||
|
Display the exporter configuration. |
|
Ex 1, Step 3: Configure the IP Interface with Tool Port and Associate with the Exporter
Create an IP interface with tool port. You must associate this IP interface with the NetFlow Exporter you configured in Ex 1, Step 2: Configure the NetFlow Generation Exporter.
Step |
Description |
UI Steps |
|||||||||||||||||||||||||||||||||
|
Identify the collector port and configure it as a tool port, where the NetFlow collector will be connected. |
|
|||||||||||||||||||||||||||||||||
|
Configure the IP interface. The IP address is for the NetFlow interface. |
|
|||||||||||||||||||||||||||||||||
|
Display the IP interface configuration. |
|
Ex 1, Step 4: Configure the Record
Configure one or more NetFlow Generation Records, which have the following:
• | Match parameters that identify unique flows |
• | Collect parameters that identify fields you want to collect for the unique flows |
Note: NetFlow v9 and IPFIX let you configure Match/Key and Collect/Non-Key elements. For details refer to NetFlow Generation Match/Key and Collect/Non-Key Elements.
The following NetFlow Record parameters apply to this example:
• | Version — the version is either NetFlow-v9 or IPFIX. The NetFlow version must be configured with the same version of the Exporter and the Record. If no version is specified, version 9 is the default. |
• | Key Fields (Match) — the parameters that identify unique flows. The available Match/Key fields are based on the configured NetFlow version. |
• | Non-Key Fields (Collect) — the parameters that identify what you want to collect for the unique flows. The number of Collect/Non-Key elements in a record can be up to 32. |
In this example, the IP source and destination address on the incoming traffic is used to identify network traffic between the unique pair of source and destination addresses. Once unique flows are identified, the following sample parameters are collected and exported for each flow:
• | IP source and destination address |
• | Total number of packets received that match the unique flows |
• | IPv4 protocol |
• | Transport source and destination ports |
• | Input and output interface, plus interface name |
• | Packet URL |
• | DNS query name |
• | Timestamp for the beginning and end of flow |
Note: Configure the NetFlow version prior to configuring the match and collect parameters because the subsequent parameters depend on the NetFlow version configured. If no version is specified, the version 9 is the default (NetFlow-v9).
Task |
Description |
UI Steps |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Configure the record. The NetFlow version must be the same as the NetFlow version specified in Ex 1, Step 2: Configure the NetFlow Generation Exporter. The record (rec2) will be used in Ex 1, Step 5: Configure the Monitor. |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Configure a second record. The NetFlow version must be the same as the NetFlow version specified in Ex 1, Step 2: Configure the NetFlow Generation Exporter. The match fields must be the same as in Step 1. Each record must have the same match fields but differing collect fields. The record (rec3) will be used in Ex 1, Step 5: Configure the Monitor. |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Display the record configuration. |
|
Ex 1, Step 5: Configure the Monitor
Configure a NetFlow Generation Monitor and associate the NetFlow Generation Record to the specified NetFlow Generation Monitor.
The following parameters show the binding of the records. The parameters also define the cache (holding statistics for unique flows).
• | Cache Timeout Event — Set to Transaction End. This applies to the TCP flow. The flow is “flushed out” to the Exporter after detecting a FIN or RST. |
• | Cache Timeout Active — Despite the flow being active, it is “flushed out” to the Exporter after this timeout, which is set in seconds. |
• | Cache Timeout inactive — Inactive flows are “flushed out” to the Exporter after this timeout, which is set in seconds. |
• | Sampling — Enables sampled NetFlow and defines the sampling rate by specifying a number for 1 in N, where N is the packet count from 10 to 16000. |
• | Records — Records generated for the flow are defined in the record and are stored in the internal cache. |
Step |
Description |
UI Steps |
|||||||||||||||||||||
|
Configure the monitor. The monitor (mon2) will be used in Ex 1, Step 8: Configure Mapping Rules to Filter Packets. The records (rec2 and rec3) were created in Ex 1, Step 4: Configure the Record. In this example, NetFlow sampling is enabled. The sampling rate is 1 in 1024. |
Cash Type: Normal Cash Timeout Event: Transaction End Cash Timeout Active: 60 Cash Timeout Inactive: 15 Sampling: 1024
Select rec2 Select rec3
|
|||||||||||||||||||||
|
Display the monitor configuration. |
|
Ex 1, Step 6: Add the monitor to the GigaSMART Group
Add the monitor created in Ex 1, Step 5: Configure the Monitor to the GigaSMART Group created in step Ex 1, Step 1: Configure the GigaSMART Group.
Note: Only one NetFlow Generation Monitor can be configured per gsgroup.
Step |
Description |
UI Steps |
||||||||||||||||||
|
Select the GigaSMART Group configured in Ex 1, Step 1: Configure the GigaSMART Group. |
|
||||||||||||||||||
|
Display the GigaSMART Group information. |
|
Ex 1, Step 7: Configure the GigaSMART Operation
Define a GigaSMART Operation to enable NetFlow Generation as follows:
Step |
Description |
UI Steps |
|||||||||||||||||||||
|
Configure the GigaSMART Operation and associate it with the GigaSMART Group created in Ex 1, Step 1: Configure the GigaSMART Group |
|
|||||||||||||||||||||
|
Display the configuration GigaSMART Operation. |
|
Ex 1, Step 8: Configure Mapping Rules to Filter Packets
To add flow mapping rules to filter packets that are needed to run NetFlow, configure a map and associate the map to the IP interface with tool port, as follows:
Step |
Description |
UI Steps |
|||||||||||||||||||||||||||
|
Configure the map. (This is a first level map.) |
Select IP Version. Set Version to 4.
|
|||||||||||||||||||||||||||
|
Display the map configuration. |
|
Example 2: NetFlow Generation Configuration
Starting in software version 4.2, NetFlow exporters can filter NetFlow records. The filtered NetFlow records are sent to the collectors.
In Example 2, there are three exporters, with filtering configured on two of them. Because the second exporter does not have any filtering configured, all the records are sent to the collector. In this example, there are also two tunnels and two maps. Both maps are first level maps.
Ex 2, Step 1: Configure the GigaSMART Group
Configure a GigaSMART group and associate it with a GigaSMART engine port, as follows:
Step |
Description |
UI Steps |
||||||||||||||||||
|
Configure the GigaSMART Group |
|
||||||||||||||||||
|
Display the information about the GigaSMART Group. |
|
Ex 2, Step 2: Configure the Exporters
Configure one or more NetFlow Generation Exporter(s), as follows:
Task |
Description |
UI Steps |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Configure the first exporter. |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Configure the second exporter. |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Configure the third exporter. |
|
Ex 2, Step 3: Configure the IP Interfaces with Tool Ports and Associate with the Exporters
In this example, create two IP interfaces with tool ports. You must associate these IP interfaces with the NetFlow Exporters in Ex 2, Step 2: Configure the Exporters.
Task |
Description |
UI Steps |
||||||||||||||||||||||||||||||||||||
|
Identify the collector ports and configure them as a tool ports, where the NetFlow collector will be connected |
|
||||||||||||||||||||||||||||||||||||
|
Configure the first IP interface. |
|
||||||||||||||||||||||||||||||||||||
|
Configure the second IP interface. |
|
||||||||||||||||||||||||||||||||||||
|
Display the IP interfaces configurations. |
|
Ex 2, Step 4: Configure the Record
Configure a NetFlow Generation Record, as follows:
Task |
Description |
UI Steps |
|||||||||||||||||||||||||||||||||||||||
|
Configure the record. |
|
|||||||||||||||||||||||||||||||||||||||
|
Display the record configuration. |
|
Ex 2, Step 5: Configure the Monitor
Configure a NetFlow Generation Monitor and associate the NetFlow Generation Record to the specified NetFlow Generation Monitor, as follows:
Task |
Description |
UI Step |
||||||||||||||||||
|
Configure the monitor. Note: In this example, NetFlow sampling is not enabled. |
|
||||||||||||||||||
|
Display the monitor configuration. |
|
Ex 2, Step 6: Add the Monitor to the GigaSMART Group
Add the monitor created in Ex 1, Step 5: Configure the Monitor to the GigaSMART Group created in step Ex 1, Step 1: Configure the GigaSMART Group.
Note: Only one NetFlow Generation Monitor can be configured per gsgroup.
Step |
Description |
UI Steps |
||||||||||||||||||
|
Select the GigaSMART Group configured in Ex 2, Step 1: Configure the GigaSMART Group. |
|
||||||||||||||||||
|
Display the GigaSMART Group information. |
|
Ex 2, Step 7: Configure the GigaSMART Operation
Define a GigaSMART Operation to enable NetFlow Generation, as follows:
Step |
Description |
UI Steps |
|||||||||||||||||||||
|
Configure the GigaSMART Operation and associate it with the GigaSMART Group created in Ex 2, Step 1: Configure the GigaSMART Group |
|
|||||||||||||||||||||
|
Display the configuration GigaSMART Operation. |
|
Ex 2, Step 8: Configure Mapping Rules to Filter Packets
To add flow mapping rules to filter packets that are needed to run NetFlow, configure maps and associate the maps to the IP interfaces with tool ports, as follows:
Task |
Description |
UI Steps |
|||||||||||||||||||||||||||||||||||||||
|
Configure the first map. (This is a first level map.) |
|
|||||||||||||||||||||||||||||||||||||||
|
Configure the second map. (This is also a first level map.) |
|
|||||||||||||||||||||||||||||||||||||||
|
Display the map configuration. |
|
Example 3: NetFlow Generation Configuration
Starting in software version 4.3.01, NetFlow supports both first level and second level maps. In Example 3, there are two maps. However, unlike Example 2, which has two first level maps, in this example, one map is a first level map and the other is a second level map. A virtual port is configured that directs traffic to the second level map.
The configuration of the GigaSMART operation in Example 3 differs from Example 1 and Example 2. The GigaSMART Operation sends traffic to APF first, and then to NetFlow.
In the first level map, the traffic matching the rule is sent to the virtual port. The same traffic is also sent to two tool ports (2/1/g2 and 2/1/g3).
In the second level map, the traffic from the virtual port matching the gsrule is sent to NetFlow and then to the IP interface with tool port, 2/1/g7.
Ex 3, Step 1: Configure the GigaSMART Group
Configure a GigaSMART group and associate it with a GigaSMART engine port, as follows:
Step |
Description |
UI Steps |
||||||||||||||||||
|
Configure the GigaSMART Group |
|
||||||||||||||||||
|
Display the information about the GigaSMART Group. |
|
Ex 3, Step 2: Configure IP Interface and Associate with Exporter
Configure the IP interface and associate with the NetFlow Generation Exporter, as follows:
Task |
Description |
UI Steps |
|||||||||||||||||||||||||||||||||
|
Configure the IP interface. |
|
Ex 3, Step 3: Configure IP Interface with Tool Port
Create an IP interface with tool port.
Step |
Description |
UI Steps |
|||||||||||||||||||||||||||||||||
|
Identify the collector port and configure it as a tool port, where the NetFlow collector will be connected. |
|
|||||||||||||||||||||||||||||||||
|
Configure the IP interface. The IP address is for the NetFlow interface. |
|
|||||||||||||||||||||||||||||||||
|
Display the IP interface configuration. |
|
Ex 3, Step 4: Configure Record
Configure a NetFlow Generation Record, as follows:
|
Description |
UI Steps |
|||||||||||||||||||||
|
Configure the record. |
Select TOS. Select IPv4 and enable Source. Select Address.
Select IPv4 and enable Source. Select Interface.
|
Ex 3, Step 5: Configure the Monitor
Configure a NetFlow Generation Monitor and associate the NetFlow Generation Record to the specified NetFlow Generation Monitor, as follows:
|
Description |
UI Steps |
|||||||||||||||
|
Configure the monitor. |
|
Ex 3, Step 6: Add the Monitor to the GigaSMART Group
Add the monitor created in Ex 3, Step 5: Configure the Monitor to the GigaSMART Group created in step Ex 3, Step 1: Configure the GigaSMART Group.
Note: Only one NetFlow Generation Monitor can be configured per gsgroup.
Step |
Description |
UI Steps |
||||||||||||||||||
|
Select the GigaSMART Group configured in Ex 3, Step 1: Configure the GigaSMART Group. |
|
||||||||||||||||||
|
Display the GigaSMART Group information. |
|
Ex 3, Step 7: Configure the GigaSMART Operation
Define a GigaSMART Operation to enable NetFlow Generation, as follows:
Step |
Description |
UI Steps |
|||||||||||||||||||||
|
Configure the GigaSMART Operation and associate it with the GigaSMART Group created in Ex 3, Step 1: Configure the GigaSMART Group |
|
|||||||||||||||||||||
|
Display the configuration GigaSMART Operation. |
|
Ex 3, Step 8: Configure the Virtual Port
For the second level map that you will create in Ex 3, Step 9: Configure Mapping Rules to Filter Packets, you will need to create a virtual port.
Configure a virtual port and associate it with the GigaSMART group, as follows:
Step |
Description |
UI Steps |
|||||||||||||||||||||
|
Configure the virtual port for the second level map. |
|
|||||||||||||||||||||
|
Display the virtual port information. |
|
Ex 3, Step 9: Configure Mapping Rules to Filter Packets
To add flow mapping rules to filter packets that are needed to run NetFlow, configure maps and associate the maps to the IP interface with tool port, as follows:
Task |
Description |
UI Steps |
|||||||||||||||||||||||||||||||||||||||
|
Configure the first map. (This is a first level map.) |
|
|||||||||||||||||||||||||||||||||||||||
|
Configure the second map. (This is a second level map.) |
|
Example 4: NetFlow Generation Configuration
Starting in software version 4.3.01, NetFlow supports both first level and second level maps. In Example 4, there are three maps. One map is a first level map and the other two are second level maps. Two virtual ports are configured that direct traffic to the second level maps.
Two GigaSMART operations are configured. One gsop sends traffic to masking. The other gsop sends traffic to APF and then to NetFlow.
In the first level map, the traffic matching the rule is sent to two virtual ports. The same traffic is also sent to a tool port (11/1/g3).
In the first second level map, the traffic from the first virtual port, vp1, that matches the gsrule, is sent to masking and then to the tool port 11/1/g2.
In the next second level map, the traffic from the second virtual port, vp2, that matches the gsrule, is sent to NetFlow and then to the IP interface with tool port, 11/1/g4.
Ex 4, Step 1: Configure the GigaSMART Group
Configure two GigaSMART groups and associate them with a GigaSMART engine port, as follows:
Step |
Description |
UI Steps |
||||||||||||||||||
|
Configure the first GigaSMART Group. |
|
||||||||||||||||||
|
Configure the second GigaSMART Group |
|
||||||||||||||||||
|
Display the information about the GigaSMART Group. |
|
Ex 4, Step 2: Configure the IP Interface with Tool Port
Create an IP interface with tool port. You must associated this IP interface with the NetFlow Exporter in Ex 4, Step 3: Configure the IP Interface and Associate with Exporter.
Step |
Description |
UI Steps |
|||||||||||||||||||||||||||||||||
|
Identify the collector port and configure it as a tool port, where the NetFlow collector will be connected. |
|
|||||||||||||||||||||||||||||||||
|
Configure the IP interface. The IP address is for the NetFlow interface. |
|
|||||||||||||||||||||||||||||||||
|
Display the IP interfaces configuration. |
|
Ex 4, Step 3: Configure the IP Interface and Associate with Exporter
Configure the IP interface and associate the NetFlow Generation Exporter, as follows:
|
Description |
Command |
|||||||||||||||||||||||||||||||||
|
Configure the IP interface. |
|
Ex 4, Step 4: Configure the Record
Configure a NetFlow Generation Record, as follows:
|
Description |
UI Steps |
|||||||||||||||||||||
|
Configure the record. |
Select IPV4 Select TOS and then select Source.
Select IPv4 and then select Protocol and Source Select Interface
|
Ex 4, Step 5: Configure the Monitor
Configure a NetFlow Generation Monitor and associate the NetFlow Generation Record to the specified NetFlow Generation Monitor, as follows:
|
Description |
Command |
||||||||||||||||||||||||
|
Configure the monitor. |
|
Ex 4, Step 6: Add the Monitor to the GigaSMART Group
Add the monitor created in Ex 4, Step 5: Configure the Monitor to the GigaSMART Group created in step Ex 4, Step 1: Configure the GigaSMART Group.
Note: Only one NetFlow Generation Monitor can be configured per gsgroup.
Step |
Description |
UI Steps |
||||||||||||||||||
|
Select the GigaSMART Group configured in Ex 4, Step 1: Configure the GigaSMART Group. |
|
||||||||||||||||||
|
Display the GigaSMART Group information. |
|
Ex 4, Step 7: Configure the GigaSMART Operation
Define the two GigaSMART operation to enable masking and NetFlow, as follows:
Step |
Description |
UI Steps |
||||||||||||||||||||||||
|
Configure the first GigaSMART Operation for APF and masking |
Protocol: None Offset: 50 Pattern: aa. Length: 100
|
||||||||||||||||||||||||
|
Configure the second GigaSMART Operation for NetFlow |
|
||||||||||||||||||||||||
|
Display the configuration GigaSMART Operation. |
|
Ex 4, Step 8: Configure the Virtual Port
For the second level map that you will create in Ex 4, Step 9: Configure Mapping Rules to Filter Packets, you will need to create virtual ports.
Configure a virtual port and associate it with the GigaSMART group, as follows:
Step |
Description |
UI Steps |
|||||||||||||||||||||
|
Configure the first virtual port for the second level map. |
|
|||||||||||||||||||||
|
Configure the second virtual port for the second level map. |
|
|||||||||||||||||||||
|
Display the virtual port information. |
|
Ex 4, Step 9: Configure Mapping Rules to Filter Packets
To add flow mapping rules to filter packets that are needed to run NetFlow, configure maps and associate the maps to the IP interfaces with tool ports, as follows:
Task |
Description |
UI Steps |
|||||||||||||||||||||||||||||||||||||||
|
Configure the first map. (This is a first level map.) |
|
|||||||||||||||||||||||||||||||||||||||
|
Configure the second map. (This is a second level map.) |
|
|||||||||||||||||||||||||||||||||||||||
|
Configure the third map. (This is also a second level map.) |
|
Display Exporter Statistics
To display exporter statistics, select GigaSMART > GigaSMART Operations (GSOP) > Statistics and open the GigaSMART Statistics Quick View to view the NetFlow Statistics.
Refer to NetFlow Exporter Statistics Definitions for descriptions of the statistics.
Display Monitor Statistics
To display exporter statistics, select GigaSMART > GigaSMART Operations (GSOP) > Statistics and open the GigaSMART Statistics Quick View to view the NetFlow Statistics.
Refer to NetFlow Monitor Statistics Definitions for descriptions of these statistics.
Display IP Interfaces Statistics
To display IP interfaces statistics, select Ports > IP Interfaces > Statistics and look for the IP interface ID in the statistics table.
Refer to IP Interfaces Statistics Definitions for descriptions of these statistics.
NetFlow Generation Configuration Modification and Removal
There may be instances where a NetFlow Generation configuration may require alteration by modifying a NetFlow Generation Monitor Configuration or a NetFlow Generation Record Configuration. It may further require that the configuration be removed entirely. In such instances, refer to the following.
Modify NetFlow Generation Monitor Configuration
This example shows the modification of a NetFlow Generation Monitor configuration.
1. | Unlink the monitor from GigaSMART Parameters. |
a. | From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups. |
b. | Select the GigaSMART group to modify. |
c. | Click Edit. |
d. | Under NetFlow, select None in the Monitor field. |
e. | Click Save. |
2. | Modify the monitor parameters. |
a. | From the device view, select GigaSMART > NetFlow / IPFIX Generation > Monitors. |
b. | Select the Monitor to modify. |
c. | Click Edit. |
d. | Under Config, modify the monitor parameters. |
e. | Select the record from the Record(s) list to re-add it to the monitor. |
3. | Re-add the monitor to GigaSMART Parameters for the changes to take affect. |
a. | From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups. |
b. | Select the GigaSMART group to modify. |
c. | Click Edit. |
d. | Under NetFlow, select the monitor in the Monitor field. |
e. | Click Save. |
Modify NetFlow Generation Record Configuration
This example shows the modification of a NetFlow Generation Record configuration.
1. | Unlink the monitor from gsparams. |
a. | From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups. |
b. | Select the GigaSMART group to modify. |
c. | Click Edit. |
d. | Under NetFlow, select None in the Monitor field. |
e. | Click Save. |
2. | Modify the record bound to the monitor. |
a. | From the device view, select GigaSMART > NetFlow / IPFIX Generation > Records. |
b. | Select the record to modify. |
c. | Click Edit. |
d. | Modify the record configuration. |
3. | Re-add the monitor to the GigaSMART Parameters for changes in record to take affect. |
a. | From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups. |
b. | Select the GigaSMART group to modify. |
c. | Click Edit. |
d. | Under NetFlow, select the monitor in the Monitor field. |
e. | Click Save. |
Remove NetFlow Generation Configuration
Use the following steps to remove a NetFlow Generation Configuration:
1. | Remove the NetFlow parameter from the GigaSMART Group. |
a. | From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups. |
b. | Select the GigaSMART Group. |
c. | Click Edit. |
d. | Under NetFlow, select None in the Monitor field. |
2. | Delete the Maps. |
a. | Select Maps > Maps > Maps. |
b. | Select Table View. |
c. | Select the Maps. |
d. | Click Delete. |
3. | Delete the IP interface. |
a. | Select Ports > IP Interfaces. |
b. | Select the port. |
c. | Click Delete. |
4. | Delete the monitor, records, and exporter |
a. | From the device view, select GigaSMART > NetFlow / IPFIX Generation > Monitors. |
b. | Select the monitor, and then click Delete. |
c. | Select Records |
d. | Select the record, and then click Delete |
e. | Select Records. |
f. | Select the record, and then click Delete. |
V5 Fixed Record Template
NetFlow v5 records have a template of fixed fields that cannot be edited. The template contains Match/Key and Collect/Non-Key elements. It has an alias of predefined_netflow_v5_record.
To display the template, select GigaSMART > NetFlow / IPFIX Generation > Records and click on predefined_netflow_v5_record to display the Record Quick View shown in Figure 9: NetFlow Record predefined_netflow_v5_record.
Figure 71 | NetFlow Record predefined_netflow_v5_record |
NetFlow Generation Match/Key and Collect/Non-Key Elements
NetFlow v9 and IPFIX records allow the user to configure Match/Key and Collect/Non-Key elements.
Match/Key Syntax
NetFlow v9 and IPFIX records allow the you to configure Match/Key elements.
Note: NetFlow v9 does not support Match/Key elements whose ID on the specified link is greater than 128. For additional information, refer to the following:
http://www.iana.org/assignments/ipfix/ipfix.xhtml
To configure the Match/Key elements, click in the Key Fields (Match) field in the NetFlow Record configuration page and select the match type.
The supported combinations of Match/Key elements are outlined in the following table:
Match Type |
Parameters |
|
|
Description |
Data Link |
Source Mac |
|
|
Supported for v9 and IPFIX. |
|
Destination |
|
|
Supported for v9 and IPFIX. |
|
VLAN |
|
|
Supported for v9 and IPFIX. |
Interface |
Input physical |
Physical Width-2 Physical Width-4 |
|
Supported for v9 and IPFIX. for width, the only supported values are 2 or 4. |
IPv4 |
Destination |
Address |
|
Configures the IPv4 destination address as a key field. Supported for v9 and IPFIX. |
|
|
Prefix |
<netmask | mask_length> |
Configures a prefix for the IPv4 destination address as a key field. Supported for v9 and IPFIX. |
|
DSCP |
|
|
Supported only for IPFIX. |
|
Fragmentation Flags |
|
|
Supported only for IPFIX. |
|
Fragmentation ID |
|
|
Supported for v9 and IPFIX. |
|
Fragmentation Offset |
|
|
Supported for v9 and IPFIX. |
|
Header Length |
|
|
Supported only for IPFIX. |
|
Option Map |
|
|
Supported only for IPFIX. |
|
Precedence |
|
|
Supported only for IPFIX. |
|
Protocol |
|
|
Supported for v9 and IPFIX. |
|
Section |
Header Size |
<size> |
Configures the number of bytes of raw data starting at the IPv4 header, to use as a key field. The range is from 1 to 128. Supported only for IPFIX. |
|
|
Payload Size |
<size> |
Configures the number of bytes of raw data starting at the IPv4 payload, to use as a key field. The range is from 1 to 128. Supported only for IPFIX. |
|
Source |
Address |
|
Supported for v9 and IPFIX. |
|
|
Prefix |
<netmask | mask_length> |
Supported for v9 and IPFIX. |
|
TOS |
|
|
Supported only for IPFIX. |
|
Total Length |
maximum | minimum |
|
Supported only for IPFIX. |
|
TTL |
|
|
Supported only for IPFIX. |
|
Version |
|
|
Supported for v9 and IPFIX. |
IPv6 |
Destination |
Address |
|
Supported for v9 and IPFIX. |
|
|
Prefix |
<netmask | mask_length> |
Supported only for IPFIX. |
|
DSCP |
|
|
Supported only for IPFIX. |
|
Extension Map |
|
|
Supported for v9 and IPFIX. |
|
Flow Label |
|
|
Supported for v9 and IPFIX. |
|
Fragmentation Flags |
|
|
Supported only for IPFIX. |
|
Fragmentation ID |
|
|
Supported for v9 and IPFIX. |
|
Fragmentation Offset |
|
|
Supported for v9 and IPFIX. |
|
Hop Limit |
|
|
Supported only for IPFIX. |
|
Length |
Header |
|
Supported only for IPFIX. |
|
|
Payload |
|
Supported only for IPFIX. |
|
|
Total |
|
Supported only for IPFIX. |
|
Next Header |
|
|
Supported only for IPFIX. |
|
payload-length |
|
|
Supported only for IPFIX. |
|
Precedence |
|
|
Supported only for IPFIX. |
|
Protocol |
|
|
Supported for v9 and IPFIX. |
|
Section |
Header Size |
<size> |
Supported only for IPFIX. The range is from 1 to 128. |
|
|
Payload Size |
<size> |
Supported only for IPFIX. The range is from 1 to 128. |
|
Source |
Address |
|
Supported for v9 and IPFIX. |
|
|
Prefix |
<netmask | mask_length> |
Supported only for IPFIX. |
|
Traffic Class |
|
|
Supported for v9 and IPFIX. |
|
Version |
|
|
Supported for v9 and IPFIX. |
Transport |
Destination Port |
|
|
Supported for v9 and IPFIX. |
|
ICMP |
IPv4 |
Code |
Supported only for IPFIX. |
|
|
|
Type |
Supported only for IPFIX. |
|
|
IPv6 |
Code |
Supported only for IPFIX. |
|
|
|
Type |
Supported only for IPFIX. |
|
Source Port |
|
|
Supported for v9 and IPFIX. |
|
TCP |
ACK Number |
|
Supported only for IPFIX. |
|
|
Destination Port |
|
Supported only for IPFIX. |
|
|
Flags <enable | disable> |
[ACK] | [CWR] | [ECE] | [FIN] | [PSH] | [RST] | [SYN] | [URG] |
Supported only for v9 and IPFIX. |
|
|
Header Length |
|
Supported only for IPFIX. |
|
|
Sequence Number |
|
Supported only for IPFIX. |
|
|
Source Port |
|
Supported only for IPFIX. |
|
|
Urgent Pointer |
|
Supported only for IPFIX. |
|
|
window-size |
|
Supported only for IPFIX. |
|
UDP |
Destination Port |
|
Supported only for IPFIX. |
|
|
Message Length |
|
Supported only for IPFIX. |
|
|
Source Port |
|
Supported only for IPFIX. |
Collect/Non-Key Syntax
NetFlow v9 and IPFIX records allow the user to configure Collect/Non-Key elements.
The number of Collect/Non-Key elements in a record can be up to 32. Each Collect/Non-Key element has a size. The accumulated size of the Collect/Non-Key elements in the record cannot exceed 1024 bytes. The supported Collect/Non-Key elements is determined either by the maximum number of elements in a record (32) or by the maximum size (1024 bytes), whichever is reached first.
Note: NetFlow v9 does not support Collect/Non-Key elements whose ID on the specified link is greater than 128. For additional information, refer to the following:
http://www.iana.org/assignments/ipfix/ipfix.xhtml
To configure the Collect/Non-Key elements, click in the Non-Key Fields (Collect) field in the NetFlow Record configuration page and select the match type.
The supported combinations of Collect/Non-Key elements are outlined in the following table:
Collect Type |
Parameters |
Size |
|
Description |
Counter |
Bytes |
32 64 |
|
Supported for v9 and IPFIX. |
|
Packets |
32 64 |
|
Supported for v9 and IPFIX. |
Datalink |
Source |
|
|
Supported for v9 and IPFIX. |
|
Mac Destination |
|
|
Supported for v9 and IPFIX. |
|
VLAN |
|
|
Supported for v9 and IPFIX. |
Flow |
End Reason |
|
|
Supported only for IPFIX. |
Interface |
Input Name |
Input Width |
[width] |
Supported for v9 and IPFIX. for width, the range is from 1 to 32. |
|
Physical |
Physical Width-2 Physical Width-4 |
|
Supported for v9 and IPFIX. For width, the only supported values are 2 or 4. |
|
Output |
Physical Width-2 Physical Width-4 |
|
Supported for v9 and IPFIX. For width, the only supported values are 2 or 4. |
IPv4 |
Destination |
Address |
|
Configures the IPv4 destination address as a non-key field. Supported for v9 and IPFIX. |
|
|
Prefix |
<netmask | mask_length> |
Supported for v9 and IPFIX. |
|
DSCP |
|
|
Supported only for IPFIX. |
|
Fragmentation Flags |
|
|
Supported only for IPFIX. |
|
Fragmentation ID |
|
|
Supported for v9 and IPFIX. |
|
Offset |
|
|
Supported for v9 and IPFIX. |
|
Header Length |
|
|
Supported only for IPFIX. |
|
Option Map |
|
|
Supported only for IPFIX. |
|
Precedence |
|
|
Supported only for IPFIX. |
|
Protocol |
|
|
Supported for v9 and IPFIX. |
|
Section |
Header Size |
<size> |
Configures the number of bytes of raw data starting at the IPv4 header, to use as a key field. The range is from 1 to 128. Supported for v9 and IPFIX. |
|
|
Payload Size |
<size> |
Configures the number of bytes of raw data starting at the IPv4 payload to use as a key field. The range is from 1 to 128. Supported for v9 and IPFIX. |
|
Source |
Address |
|
Supported for v9 and IPFIX. |
|
|
Prefix |
<netmask | mask_length> |
Configures a prefix for the IPv4 destination address as a non-key field. Supported for v9 and IPFIX. |
|
TOS |
|
|
Supported only for IPFIX. |
|
Total Length |
[maximum] |
|
Supported only for IPFIX. |
|
|
[minimum] |
|
Supported only for IPFIX. |
|
TTL |
|
|
Supported only for IPFIX. |
|
Version |
|
|
Supported for v9 and IPFIX. |
IPv6 |
Destination |
Address |
|
Supported for v9 and IPFIX. |
|
|
Prefix |
<netmask | mask_length> |
Supported only for IPFIX. |
|
DSCP |
|
|
Supported only for IPFIX. |
|
Extension Map |
|
|
Supported for v9 and IPFIX. |
|
Flow Label |
|
|
Supported for v9 and IPFIX. |
|
Fragmentation Flags |
|
|
Supported only for IPFIX. |
|
Fragmentation ID |
|
|
Supported for v9 and IPFIX. |
|
Fragmentation Offset |
|
|
Supported for v9 and IPFIX. |
|
Hop Limit |
[maximum] |
|
Supported only for IPFIX. |
|
|
[minimum] |
|
Supported only for IPFIX. |
|
Length |
Header |
|
Supported for v9 and IPFIX. |
|
|
Payload |
|
Supported only for IPFIX. |
|
|
Total |
[maximum] |
Supported only for IPFIX. |
|
|
|
[minimum] |
Supported only for IPFIX. |
|
Next Header |
|
|
Supported only for IPFIX. |
|
Precedence |
|
|
Supported only for IPFIX. |
|
Protocol |
|
|
Supported for v9 and IPFIX. |
|
Section |
Header Size |
<size> |
Supported only for IPFIX. The range is from 1 to 128. |
|
|
Payload Size |
<size> |
Supported only for IPFIX. The range is from 1 to 128. |
|
Source |
Address |
|
Supported for v9 and IPFIX. |
|
|
Prefix |
<netmask | mask_length> |
Configures a prefix for the IPv4 destination address as a non-key field. Supported only for IPFIX. |
|
Traffic Class |
|
|
Supported for v9 and IPFIX. |
|
Version |
|
|
Supported for v9 and IPFIX. |
Private |
PEN <pen name> |
DNS |
<additional-class [number-of-collects <1-10>] | |
Supported only for IPFIX. |
Private (continued) |
PEN <pen name> |
DNS |
query-type-text [number-of-collects <1-10>] | |
Supported only for IPFIX. |
Private |
PEN <pen name> |
HTTP |
Response Code |
Supported only for IPFIX. |
Private |
PEN <pen name> |
HTTP |
URL |
Supported only for IPFIX. For width, the range is from 1 to 250. |
Private |
PEN <pen name> |
HTTP |
User Agent |
Supported only for IPFIX. For width, the range is from 1 to 250. |
Private |
PEN <pen name> |
SSL Certificate |
<Issuer [width] | |
Supported only for IPFIX. For width of Issuer and Subject, the range is from 1 to 250. For width of Issuer Common Name, Subject Alternative Name, and Subject Common Name, the range is from 1 to 64. |
Private |
PEN <pen name> |
SSL Server |
<Cipher | |
Supported only for IPFIX. For width, the range is from 1 to 64. |
Private |
PEN <pen name> |
URL |
[width] |
Supported only for IPFIX. For width, the range is from 1 to 250. |
timestamp |
Sys-uptime First |
|
|
Supported for v9 and IPFIX. |
|
Sys-uptime First Last |
|
|
Supported for v9 and IPFIX. |
transport |
Destination Port |
|
|
Supported for v9 and IPFIX. |
|
ICMP |
IPv4 Code |
|
Supported only for IPFIX. |
|
|
IPv4 Code Type |
|
Supported only for IPFIX. |
|
|
ipv6 Code |
|
Supported only for IPFIX. |
|
|
ipv6 Type |
|
Supported only for IPFIX. |
|
Source Port |
|
|
Supported for v9 and IPFIX. |
|
TCP Flags |
[ACK] | [CWR] | [ECE] | [FIN] | [PSH] | [RST] | [SYN] | [URG] |
|
Supported for v9 and IPFIX. |
|
TCP |
ACK Number |
|
Supported only for IPFIX. |
|
|
Destination Port |
|
Supported only for IPFIX. |
|
|
Header Length |
|
Supported only for IPFIX. |
|
|
Sequence Number |
|
Supported only for IPFIX. |
|
|
Source Port |
|
Supported only for IPFIX. |
|
|
Urgent Pointer |
|
Supported only for IPFIX. |
|
|
Window Size |
|
Supported only for IPFIX. |
|
UDP |
Destination Port |
|
Supported only for IPFIX. |
|
|
Message Length |
|
Supported only for IPFIX. |
|
|
Source Port |
|
Supported only for IPFIX. |