GigaSMART NetFlow Generation

Required License: NetFlow Generation
Required License for NetFlow with Second Level Maps: Adaptive Packet Filtering (APF)

NetFlow Generation is a simple and effective way to increase visibility into traffic flows and usage patterns across systems. The flow-generated data can be used to build relationships and usage patterns between nodes on the network. Routers and switches that support NetFlow can collect IP traffic statistics to be exported as NetFlow records.

However, the processor and memory load of enabling NetFlow can cause service degradation and affect their ability to pass traffic without introducing latency and packet drops. Due to this processing overhead, sampled NetFlow is implemented in most of the high-end routers. Sampling in every “N” packets for NetFlow processing can severely limit the visibility needed to monitor flows.

The advanced capabilities of GigaSMART® technology can be leveraged to summarize and generate unsampled NetFlow statistics from incoming traffic streams. Offloading NetFlow Generation to an out-of-band solution like the Gigamon Visibility Platform completely eliminates the risk of using core production network resources in generating this data. Combined with the flexibility offered by Gigamon’s patented Flow Mapping®® technology, operators can pick and choose from which flows to generate NetFlow statistics, while at the same time sending the original packets to other monitoring tools.

Support for NetFlow versions 5 and 9 and IP Information Export (IPFIX), as well as CEF, enables seamless integration with standards-based collectors. NetFlow records can also be exported to multiple collectors concurrently, providing a single flow source for business-critical management applications such as security, billing, and capacity planning. Exported flows can also be filtered so that collectors only receive the specific records relevant to them.

Note:  Legacy NetFlow supports only one NetFlow version (v5,v9, or IPFIX) record and NetFlow exporter format version per engine unless the exporter format is CEF.

Gigamon has also extended IPFIX to include URL information, providing insight into HTTP and SIP traffic. Other enterprise extensions for IPFIX are HTTP, DNS, and SSL certificates, which provide metadata that can be used for security analysis.

Additionally, Gigamon’s Visibility Platform architecture is the first in the industry to summarize flow statistics as well as to provide the flexibility of aggregating, replicating, filtering, and forwarding raw traffic streams to monitoring tools for detailed troubleshooting and analytics.

The Gigamon Visibility Platform establishes a scalable framework to deliver pervasive flow-level visibility across enterprises, data centers, and service provider environments to accurately design, engineer, optimize, and manage their network infrastructure.

Note:  NetFlow Generation exports records using IPv4. IPv6 is not supported.

GigaSMART operations with a NetFlow component can be assigned to multiple GigaSMART groups or GigaSMART groups consisting of multiple GigaSMART engine ports.

NetFlow/IPFIX Generation is a pillar of the GigaSECURE Security Delivery Platform.

NetFlow Generation is displayed in Figure 1: NetFlow Generation Gigamon Solution.

Figure 81 NetFlow Generation Gigamon Solution

In Figure 1: NetFlow Generation Gigamon Solution, incoming packets from network(s) enter the Gigamon Visibility Platform and are directed by maps to NetFlow. NetFlow examines the incoming packets and converts the packets of choice into flows records. Specific flows are then forwarded to specific tools, such as Security, Application Performance, and Customer Experience Management (CEM) tools.

NetFlow Generation Components

NetFlow Generation collects IP traffic statistics on all interfaces where a NetFlow Monitor is enabled. It then gathers the statistics of the traffic flows and exports the NetFlow records to at least one NetFlow collector (typically a device that performs the actual traffic analysis based on the information from the NetFlow records).

Figure 2: NetFlow Generation Components shows the NetFlow Generation components.

Figure 82 NetFlow Generation Components

: illustrates the NetFlow Generation and how its components are associated. The NetFlow Generation associates its components in the following order:

1.   One or more Records are associated to the Monitor.
2. The Monitor is associated to the GigaSMART group.
3. The Exporter is associated to the IP interface with tool port.
4. The map will eventually bind to the Exporter, Record, and Monitor.

Note:  The dotted line from the map represents the interaction between the NetFlow Generation components.

Refer to Example 1: NetFlow Generation Configuration on page 631 for an example configuration of the following components.

Network Ports

NetFlow operates on the network flow. The incoming traffic on the network ports contains inputs such as, source and destination IP addresses, source and destination ports, interfaces, and so on. The network ports provide traffic to maps.

Map(s)

Traffic is received and acted upon according to maps. Maps determine what traffic is forwarded to NetFlow. Through map configuration, you add rules to filter the packets that need to go to NetFlow, and associate the map to the IP interface with tool port to specify where to send the filtered traffic.

Starting in software version 4.3.01, NetFlow supports both first level and second level maps. First level maps contain flow mapping rules to filter traffic that is needed by NetFlow and then send the filtered traffic to the IP interface with tool ports.

Second level maps are used for configuring filtering rules enabled through Adaptive Packet Filtering (APF). A virtual port is configured that directs traffic to the second level map. After the APF rules are applied, the filtered traffic that is needed by NetFlow is sent to the IP interface tool ports.

For examples of first level maps, refer to Example 1: NetFlow Generation Configuration and Example 2: NetFlow Generation Configuration.

For examples of first and second level maps, refer to Example 3: NetFlow Generation Configuration and Example 4: NetFlow Generation Configuration.

GigaSMART Group

The GigaSMART group specifies the GigaSMART engine to use, such as 8/1/e1 or
8/1/e2.

GSOP

The GigaSMART operation enables NetFlow. If a second level map is configured, the GigaSMART operation directs traffic to APF first, and then to NetFlow.

NetFlow Records

A NetFlow record contains key elements that specify what to match in the flow, such as all packets with the same source and destination port, or anything that comes in on a particular interface. A flow record also contains non-key elements that specify what information to collect for the flow, such as when the flow started or the number of bytes in the flow.

For NetFlow-v5, the fields in the flow record are fixed. For details, refer to V5 Fixed Record Template on page 657.

For NetFlow-v9 and IPFIX, you configure the fields, and thus create a record template. You specify how the fields are organized and in what order. The template is sent to the collector, so the collector knows what fields to expect in a NetFlow record. The template is sent periodically.

Starting in software version 4.6, multiple records are supported. An increased number of records allows more NetFlow data to be exported.

The maximum number of records is five. For all five records, each record must have the same match fields but differing collect fields. The same match fields will define the flows being considered. The different collect fields will define multiple templates sent to the NetFlow servers.

Starting in software version 5.1 for IPFIX and software version 5.2 for v5 and v9, a mix of IPv4 and IPv6 collect fields (IPv4 source/destination and IPv6 source/destination) are not supported in one record. Instead, create two records, one for IPv4 collect fields and one for IPv6 collect fields. When the IPv4/IPv6 collect fields are in separate records, an exporter will only send out records with non-blank elements.

NetFlow Monitors

Monitors store the NetFlow records associated with them. The configuration of a monitor includes the definition of the cache that specifies the records that you want to store, as well as timeouts associated with the cache. The cache can contain up to 4 million entries.

There can be a maximum of two monitors on a GigaSMART line card or module, one associated with each e port.

Starting in software version 4.6, up to five records can be added to the monitor. This results in the creation of five templates. For all five records, each record must have the same match fields but differing collect fields.

Sampled NetFlow Data

NetFlow data can be sampled. Sampling reduces the amount of ingress traffic sent to NetFlow for processing, which reduces the load on external collectors.

A NetFlow monitor can have multiple records with different sampling rates. The records are only updated with packets at the rate specified.

The following types of sampling are available: single-rate or multi-rate, as well as no sampling.

Sampling is enabled and disabled on the NetFlow monitor, across all flows. When sampling is enabled, you define the sampling rate by specifying a number for 1 in N, where N is the packet count.

For single-rate, the number can be from 10 to 16000. For multi-rate, the number can be from 1 to 16000. Single-rate applies to all records, whereas multi-rate applies to any record.

Note:  In a single-rate sampling type, all the NetFlow records are sampled in the same rate. In multi-rate sampling type, the sampling rate of the NetFlow records differ according to the settings defined in the individual records.

For example, if sampling is 1 in 1024, 1 packet in 1024 will be selected for NetFlow. The default is 1 in 1, which means no sampling.

Note:  The sampling mode in this release is deterministic. The selection of the packet is not random. Deterministic sampling means that if the rate is 1 in 1024, after 1023 packets, the 1024th packet is selected, while packets 1 to 1023 are ignored.

NetFlow Exporters

NetFlow records are sent to exporters. Each exporter is associated with one external collector. Records can be exported to both IPv4 and IPv6 destination. Either IPv4 or IPv6 destination address can be configured in an exporter. There can be up to six exporters that send flow records to up to six external collectors. The six destinations are per GigaSMART engine.

The configuration of an exporter includes the IP address of a collector, the transport protocol and destination port, and the template refresh interval, which specifies the frequency of when the record template is sent to the collector.

Starting in software version 5.1, an option is added to assign different exporters to different records. Instead of records being sent to all exporters, you can add an exporter to a record, which defines the exporter to which the record is sent.

IP Interface with Tool Ports

NetFlow exporters are associated with IP interface, since exporters route both records and templates to collectors in the network.

Note:  It is expected that the gateway specified in the IP interface configuration does Layer 3 routing. However, when the IP interface and the collector’s IP address are in the same subnet, the following applies:

Configure the IP interface’s gateway IP address to the same as the collector’s IP address.
Configure the IP interface’s subnet mask.
The maximum number of exporters supported per GigaSMART group is six.

Enhancements to NetFlow

In addition to the NetFlow components, there are also the following enhancements:

Exporter Filtering
Remote Interface IDs
NetFlow Option Templates
IPFIX Extension: HTTP Response Code
IPFIX Extension: Packet URL
IPFIX Extension: User Agent
IPFIX Extension: Domain Name Service (DNS)
IPFIX Extension: SSL Metadata
SNMP Packet Support on IP Interfaces with Tool Ports 
NetFlow Format Support on Exporters

 

 

Configure NetFlow Generation

The following are the step for setting up a typical NetFlow Generation configuration with H-VUE:

Step 1: Configure a GigaSMART Group
Step 2: Configure the NetFlow Exporter
Step 3: Configure an IP Interface
Step 4: Configure the NetFlow Record
Step 5: Configure the NetFlow Monitor
Step 6: Add the NetFlow Monitor to GigaSMART Group
Step 7: Configure the GigaSMART Operation
Step 8: Configure Mapping Rules to Filter Packets

Step 1: Configure a GigaSMART Group

Configure a GigaSMART Group using the following steps. you will use this GigaSMART Group in Step 6: Add the NetFlow Monitor to GigaSMART Group, where you assign a NetFlow Monitor to the group.

1.   From the device view, select GigaSMART > GigaSMART Groups.
2. Click New to create a new GigaSMART Group or select an existing GigaSMART Group and click Edit.
3. Enter an alias to help identify this GigaSMART group. For example, Netflow-gsgrp
4. Select an engine port (the e port references the GigaSMART line card or module) Your GigaSMART group should look similar to the example shown in the following figure.

5. Click Save.

Notes:

The GigaSMART Group can contain multiple GigaSMART engine ports.
Only one NetFlow Generation Monitor can be configured per GigaSMART Group.

Step 2: Configure the NetFlow Exporter

Configure one or more NetFlow Generation Exporters. There can be up to six NetFlow Generation Exporters for each NetFlow Generation Monitor.

To access GigaSMART within GigaVUE-FM, access a device that has been added to GigaVUE-FM from the GigaVUE-FM interface. GigaSMART appears in the navigation pane of the device view on supported devices. Refer to the Access GigaSMART from GigaVUE-FM for details.

To configure the NetFlow Exporter, do the following:

1.   From the device view, select GigaSMART > NetFlow / IPFIX Generation > Exporters.
2. Click New. The NetFlow Exporters page appears.
3. On the NetFlow Exporter page, enter the information for the exporter. Table 2: NetFlow ExporterConfiguration Fields describes the fields.

Note:  The NetFlow version must be configured with the same version of the Exporter and the Record. If no version is specified, version 9 is the default.

4. Under the Filters section, click Add a Rule to create a filter for the exporter.
5. Click Save.

Table 2: NetFlow ExporterConfiguration Fields

Field

Description

Alias

The alias name for the NetFlow Exporter.

Description

An optional description of the NetFlow record.

Format

The format is either NetFlow or CEF.

Version

The version is either NetFlow-v9, NetFlow-v5, or IPFIX.

Template Refresh Interval

After each template-refresh-interval, the record template is sent to the collector. Also, the option template is sent.

SNMP

Enables SNMP packet support on IP interfaces associated with the NetFlow Exporter.

Transport Protocol

The UDP port of the collector. This value cannot be changed.

IP Version

IP Version of the destination IP. You can select IPv4 or IPv6. Default is set as v4.

Destination IP

The IP address of the NetFlow/IPFIX collector. Default is set as 0.0.0.0.

Destination Port

Port for the destination IP. Default is set as 2055.

DSCP

The DSCP priority of the packet. Default is set as 0.

TTL

The Time to Live of the packet. Default is set as 64.

Step 3: Configure an IP Interface

In this step, you identify the collector port and configure it as a tool port, where the NetFlow collector will be connected, and then configure an IP interface. The steps are as follows:

1.   Select the port to use and configure it as a tool port.
a. Select Ports > Ports > All Ports.
b. Click the Quick Port Editor button to open the Quick Port Editor.
c. In the Quick Port Editor select the port to use for the IP interface, provide an alias to help identify the port (for example, NetFlow_Tunnel_Port), select Tool for the port type, and select Enable.
d. Click OK.
2. Select Ports > IP Interfaces.
3. Click New.
4. On the IP Interface page, do the following:
a. In the Alias and Comment fields, enter a name and description for the IP interface.
b. From the Port drop-down list, select the tool port that you configured in Step 1.
c. Select the type of IP interface as either IPv4 or IPv6.
d. Enter the IP Address, IP Mask, Gateway address, and MTU value.
e. From the GigaSMART Group drop-down list, select the GigaSMART group you created in Step 1: Configure a GigaSMART Group.
f. From the Exporters drop-down list, select the NetFlow exporter you created in Step 2: Configure the NetFlow Exporter.

Step 4: Configure the NetFlow Record

Configure a NetFlow Generation Record that has the following:

match parameters that identify unique flows
collect parameters that identify fields you want to collect for the unique flows

To access GigaSMART within GigaVUE-FM, access a device that has been added to GigaVUE-FM from the GigaVUE-FM interface. GigaSMART appears in the navigation pane of the device view on supported devices. Refer to the Access GigaSMART from GigaVUE-FM for details.

To configure the NetFlow Record, do the following:

1.   From the device view, select GigaSMART > NetFlow / IPFIX Generation > Records.
2. Click New. The NetFlow record page shown in Figure 7: NetFlow Record Page displays.

Figure 87 NetFlow Record Page
3. On the NetFlow Record page, do the following:
a. Specify the NetFlow Record information:
Enter an alias to help identify the record
Enter a Description (optional)
Enter the Sampling Rate that you want
Select the Exporter that you want from the Exporters menu
Select the Version

The Version is either NetFlow-v9 or IPFIX. The NetFlow version must be configured with the same version of the Exporter and the Record. NetFlow-v9 is the default.

The Sampling Rate is multi-rate only, and is specified as 1 in N, where N is the packet count. The packet count can be a number from 1 to 16000. Refer to Sampled NetFlow Data. The Sampling Rate is disabled by default.

NetFlow-v9 and IPFIX let you configure Match/Key and Collect/Non-Key elements.

Make sure that you configure the NetFlow version prior to configuring the match and collect parameters because the subsequent parameters depend on the NetFlow version configured.

b. Specify the Configuration:

Key Fields (Match) — the parameters that identify unique flows. The available Match/Key fields are based on the configured NetFlow version

Non-Key Fields (Collect) — the parameters that identify what you want to collect for the unique flows. The number of Collect/Non-Key elements in a record can be up to 32.

For details about the match and collect parameters, refer to NetFlow Generation Match/Key and Collect/Non-Key Elements

Step 5: Configure the NetFlow Monitor

Configure a NetFlow Generation Monitor and associate the NetFlow Generation Record to the specified NetFlow Generation Monitor by doing the following:

1.   From the device view, select GigaSMART > NetFlow / IPFIX Generation > Monitors.
2. Click New. The Monitors page displays.
3. On the Monitors page, do the following:
a. Enter an Alias to identify the monitor.
b. Enter a Description (optional).
c. Configure the Cache parameters. Refer to Table 3: NetFlow Monitor Parameters.
d. Configure the Sampling parameters. Refer to Table 3: NetFlow Monitor Parameters.
e. Select the Record that you configured in Step 4: Configure the NetFlow Record.
4. Click Save.

Table 3: NetFlow Monitor Parameters

Parameter

Description

Cache Type

Set as Normal.

Cache Timeout Active

Despite the flow being active, it is “flushed out” to the Exporter after this timeout, which is set in seconds.

Cache Timeout Inactive

Inactive flows are “flushed out” to the Exporter after this timeout, which is set in seconds.

Cache Timeout Event

Applies to the TCP flow. The flow is “flushed out” to the Exporter after detecting a FIN or RST.

Mode

Select the sampling mode that you want:

No sampling
Multi rate
Single rate

Single Sampling Rate

Refer to Sampled NetFlow Data.

Step 6: Add the NetFlow Monitor to GigaSMART Group

Return to the GigaSMART Group configured in Step 1: Configure a GigaSMART Groupand set the NetFlow Monitor to the monitor created in Step 2: Configure the NetFlow Exporter.

1.   From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups.
2. Select the GigaSMART Group configured in Step 1: Configure a GigaSMART Group, and then click Edit.
3. Under GigaSMART Parameters, go to NetFlow. Click in the Monitor field and select the NetFlow monitor configured in Step 5: Configure the NetFlow Monitor as shown in the following figure.

4. Click Save.

Step 7: Configure the GigaSMART Operation

Define a GigaSMART operation to enable NetFlow Generation. If combining NetFlow with APF or Deduplication GSOPs, make sure that you select both operations when creating the GigaSMART Operation.

To access GigaSMART within GigaVUE-FM, access a device that has been added to GigaVUE-FM from the GigaVUE-FM interface. GigaSMART appears in the navigation pane of the device view on supported devices. Refer to the Access GigaSMART from GigaVUE-FM for details.

To configure the GigaSMART Operation, do the following:

1.   From the device view, select GigaSMART > GigaSMART Operations (GSOP).
2. Click New. The GigaSMART Operations (GSOP) page displays. (Refer to Figure 8: GigaSMART Operation (GSOP) Page.)
3. On the GigaSMART Operations page, do the following:
a. In the Alias field, enter a alias to help identify this gsop.
b. In the GigaSMART Groups field, select the gsop configured in Step 1: Configure a GigaSMART Group.

dIn the GigaSMART Operations (GSOP) field, select NetFlow. The NetFlow GigaSMART Operation is enabled by default as shown in Figure 8: GigaSMART Operation (GSOP) Page.

Figure 88 GigaSMART Operation (GSOP) Page
4. Click Save.

Step 8: Configure Mapping Rules to Filter Packets

To add flow mapping rules to filter packets that are needed to run NetFlow, configure a map and associate the map to the IP interface with tool port.

For more detailed information about flow mapping, refer to About Flow Mapping® and Manage Maps.

Notes:

For a single NetFlow GigaSMART Operation, make sure that you create a Regular By Rule map. When combining with APF or Deduplication, use First Level or Single Level map types.
Make sure that the other combining GigaSMART Operations are configured before creating maps using NetFlow.
When combining NetFlow with APF or Deduplication, create virtual ports to use with the second level maps.
The destination tool port must be the IP interface with tool port identified in Step 3: Configure an IP Interface

For second level maps, you will need to create virtual ports. To create virtual ports, do the following:

1.   From the device view, select GigaSMART > Virtual Ports.
2. Click New. The Virtual Ports page displays.
3. Enter an alias in the Alias field to identify the virtual port.
4. In the GigaSMART Groups field, select the GigaSMART Group configured in Step 1: Configure a GigaSMART Group.
5. Click Save.

To configure mapping rules to filter packets, do the following:

1.   Select Maps > Maps > Maps.
2. Click New to create a new map.
3. On the New Map page, do the following:
a. Enter an alias in the Alias field and select the map Type and Subtype.
b. Specify Source and Destination ports.
c. In the GigaSMART Operations (GSOP) field, select the GigaSMART Operation configured in Step 7: Configure the GigaSMART Operation.
d. Click Add a Rule to add the rules needed for the map.
4. Click Save.

Configure NetFlow Generation Examples

The following sections provide examples of NetFlow Generation.

Example 1: NetFlow Generation Configuration
Example 2: NetFlow Generation Configuration
Example 3: NetFlow Generation Configuration
Example 4: NetFlow Generation Configuration

Example 1: NetFlow Generation Configuration

In Example 1, the steps set up a typical NetFlow Generation configuration.

Ex 1, Step 1: Configure the GigaSMART Group

Configure a GigaSMART group and associate it with a GigaSMART engine port.

Step

Description

UI Steps

1.    

Configure the GigaSMART Group

a. From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups.
b. Click New.
c. Type gsgp2 in the Alias field to identify this GigaSMART Group.
d. Click in the Port List field and select an engine port. For example, 1/5/e1.
e. Click Save.
2.  

Display the information about the GigaSMART Group.

On the GigaSMART Group page, click on the alias gsgp2 to display the GigaSMART Group Quick View.

Ex 1, Step 2: Configure the NetFlow Generation Exporter

Configure one or more NetFlow Generation Exporters. There can be up to 6 NetFlow Generation Exporters for each NetFlow Generation Monitor.

The following parameters apply to this example:

Transport Protocol — the UDP port of the collector.
Version — the version is either NetFlow-v9 or IPFIX. The NetFlow version must be configured with the same version of the Exporter and the Record. If no version is specified, version 9 is the default.
Template Refresh Interval — after each template-refresh-interval, the record template is sent to the collector. Also, the option template is sent.
SNMP — enables SNMP packet support for the NetFlow exporter.
Destination IP — the IP address of the NetFlow/IPFIX collector.
DSCP — the DSCP priority of the packet.
TTL — the Time to Live of the packet.

Step

Description

UI Steps

1.    

Configure the exporter. The exporter (exp4) will be used in Ex 1, Step 8: Configure Mapping Rules to Filter Packets.

a. From the device view, select GigaSMART > NetFlow / IPFIX Generation > Exporters.
b. Click New.
c. Set NetFlow Exporter Info as follows:

Alias: exp4.

Version: IPFIX

Template Refresh Interval: 60

d. Enable SNMP.
e. Set Transport Configuration.

Transport Protocol: UDP

IP Version: v4

Destination IP: 20.20.20.20

Destination Port: 2055

DSCP: 10

TTL: 64

f. Click Save.
2.  

Display the exporter configuration.

a. From the device view, select GigaSMART > NetFlow / IPFIX Generation > Exporters.
b. Click on the row with the alias exp4 to display the details in the Exporter Quick View.

Ex 1, Step 3: Configure the IP Interface with Tool Port and Associate with the Exporter

Create an IP interface with tool port. You must associate this IP interface with the NetFlow Exporter you configured in Ex 1, Step 2: Configure the NetFlow Generation Exporter.

Step

Description

UI Steps

1.    

Identify the collector port and configure it as a tool port, where the NetFlow collector will be connected.

a. Identify the port to use as an IP interface with tool port. For example, 1/1/g3.
b. Select Ports > All Ports.
c. Use the Quick Port Editor to configure port 1/1/g3 as a tool port.
2.  

Configure the IP interface. The IP address is for the NetFlow interface.

a. Select Ports > IP Interfaces.
b. Click New.
c. In the Alias and Comment fields, enter the name and description of the IP interface.
d. From the Port drop-down list, select port 1/1/g3.
e. Enter 10.10.10.10 in the IP Address field.
f. Enter 255.255.255.255 in the Mask field
g. Enter 10.10.10.1 in the Gateway field.
h. Enter 1500 in the MTU field.
i. Select the GigaSMART Group created in Ex 1, Step 1: Configure the GigaSMART Group.
j. Click Save.
3.  

Display the IP interface configuration.

a. Select Ports > IP Interfaces.
b. Click on the row for port 1/1/g3 to display the IP interface details in a Quick View.

Ex 1, Step 4: Configure the Record

Configure one or more NetFlow Generation Records, which have the following:

Match parameters that identify unique flows
Collect parameters that identify fields you want to collect for the unique flows

Note:   NetFlow v9 and IPFIX let you configure Match/Key and Collect/Non-Key elements. For details refer to NetFlow Generation Match/Key and Collect/Non-Key Elements.

The following NetFlow Record parameters apply to this example:

Version — the version is either NetFlow-v9 or IPFIX. The NetFlow version must be configured with the same version of the Exporter and the Record. If no version is specified, version 9 is the default.
Key Fields (Match) — the parameters that identify unique flows. The available Match/Key fields are based on the configured NetFlow version.
Non-Key Fields (Collect) — the parameters that identify what you want to collect for the unique flows. The number of Collect/Non-Key elements in a record can be up to 32.

In this example, the IP source and destination address on the incoming traffic is used to identify network traffic between the unique pair of source and destination addresses. Once unique flows are identified, the following sample parameters are collected and exported for each flow:

IP source and destination address
Total number of packets received that match the unique flows
IPv4 protocol
Transport source and destination ports
Input and output interface, plus interface name
Packet URL
DNS query name
Timestamp for the beginning and end of flow

Note:  Configure the NetFlow version prior to configuring the match and collect parameters because the subsequent parameters depend on the NetFlow version configured. If no version is specified, the version 9 is the default (NetFlow-v9).

Task

Description

UI Steps

1.    

Configure the record. The NetFlow version must be the same as the NetFlow version specified in Ex 1, Step 2: Configure the NetFlow Generation Exporter.

The record (rec2) will be used in Ex 1, Step 5: Configure the Monitor.

a. From the device view, select GigaSMART > NetFlow / IPFIX Generation > Records.
b. Click New.
c. Type rec2 in the Alias field.
d. Select IPFIX for Version.
e. Click in the Key Fields (Match) field and select IPv4.
Select Source, and then select Address
Select Destination, and then select Address
f. Click in Non-Key Fields (Collect) and Select IPv4.
Select Source, and then select Address
Select Destination, and then select Address
g. Click in Non-Key Fields (Collect) and select Counter.
Select Bytes
Select Packets
h. Click in Non-Key Fields (Collect) and select Transport.
Select Source Port
i. Click in Non-Key Fields (Collect) and select Interface.
Select Output
j. Click in Non-Key Fields (Collect) and select Private.
PEN is gigamon
Select URL
k. Click in Non-Key Fields (Collect) and select Timestamp.
Select Sys-Uptime First
Select Sys-Uptime Last
l. Click Save.
2.  

Configure a second record. The NetFlow version must be the same as the NetFlow version specified in Ex 1, Step 2: Configure the NetFlow Generation Exporter. The match fields must be the same as in Step 1. Each record must have the same match fields but differing collect fields.

The record (rec3) will be used in Ex 1, Step 5: Configure the Monitor.

a. From the device view, select GigaSMART > NetFlow / IPFIX Generation > Records.
b. Click New.
c. Type rec3 in the Alias field.
d. Select IPFIX for Version.
e. Click in the Key Fields (Match) field and select IPv4.
Select Source, and then select Address
Select Destination, and then select Address
f. Click in Non-Key Fields (Collect) and Select IPv4.
Select Source, and then select Address
Select Destination, and then select Address
g. Click in Non-Key Fields (Collect) and select Private.
PEN is gigamon
Select URL
Select Query Name under DNS
h. Click in Non-Key Fields (Collect) and select Timestamp.
Select Sys-Uptime First
Select Sys-Uptime Last
i. Click Save.
3.  

Display the record configuration.

Click on the row with the alias rec2 to display the Record Quick View.

Ex 1, Step 5: Configure the Monitor

Configure a NetFlow Generation Monitor and associate the NetFlow Generation Record to the specified NetFlow Generation Monitor.

The following parameters show the binding of the records. The parameters also define the cache (holding statistics for unique flows).

Cache Timeout Event — Set to Transaction End. This applies to the TCP flow. The flow is “flushed out” to the Exporter after detecting a FIN or RST.
Cache Timeout Active — Despite the flow being active, it is “flushed out” to the Exporter after this timeout, which is set in seconds.
Cache Timeout inactive — Inactive flows are “flushed out” to the Exporter after this timeout, which is set in seconds.
Sampling — Enables sampled NetFlow and defines the sampling rate by specifying a number for 1 in N, where N is the packet count from 10 to 16000.
Records — Records generated for the flow are defined in the record and are stored in the internal cache.

Step

Description

UI Steps

1.    

Configure the monitor. The monitor (mon2) will be used in Ex 1, Step 8: Configure Mapping Rules to Filter Packets.

The records (rec2 and rec3) were created in Ex 1, Step 4: Configure the Record.

In this example, NetFlow sampling is enabled. The sampling rate is 1 in 1024.

a. From the device view, select GigaSMART > NetFlow > Monitors.
b. Click New.
c. Type mon2 in the Alias field.
d. Define Config

Cash Type: Normal

Cash Timeout Event: Transaction End

Cash Timeout Active: 60

Cash Timeout Inactive: 15

Sampling: 1024

e. Select Record(s)

Select rec2

Select rec3

f. Click Save.
2.  

Display the monitor configuration.

Click on the row with the alias mon2 to display the Monitor Quick View.

Ex 1, Step 6: Add the monitor to the GigaSMART Group

Add the monitor created in Ex 1, Step 5: Configure the Monitor to the GigaSMART Group created in step Ex 1, Step 1: Configure the GigaSMART Group.

Note:  Only one NetFlow Generation Monitor can be configured per gsgroup.

Step

Description

UI Steps

1.    

Select the GigaSMART Group configured in Ex 1, Step 1: Configure the GigaSMART Group.

a. From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups.
b. On the GigaSMART Groups page, select gsgp2.
c. Click Edit.
d. Click in the Monitor field and select the NetFlow Monitor created in Ex 1, Step 5: Configure the Monitor
e. Click Save.
2.  

Display the GigaSMART Group information.

a. From the device view, select GigaSMART Groups > GigaSMART Groups.
b. On the GigaSMART Groups page, click on the alias to display the information in a Quick View.

Ex 1, Step 7: Configure the GigaSMART Operation

Define a GigaSMART Operation to enable NetFlow Generation as follows:

Step

Description

UI Steps

1.    

Configure the GigaSMART Operation and associate it with the GigaSMART Group created in Ex 1, Step 1: Configure the GigaSMART Group

a. From the device view, select GigaSMART > GigaSMART Operations (GSOP) > GigaSMART Operation.
b. Click New.
c. Type an alias in the Alias field to identify this operation. For example, gsop2.
d. For GigaSMART Groups, select gsgp2.
e. For GigaSMART Operations (GSOP), select NetFlow.
f. Click Save.
2.  

Display the configuration GigaSMART Operation.

On the GigaSMART Operations page, click on the alias gsop2 to open the GigaSMART Operation Quick View.

Ex 1, Step 8: Configure Mapping Rules to Filter Packets

To add flow mapping rules to filter packets that are needed to run NetFlow, configure a map and associate the map to the IP interface with tool port, as follows:

Step

Description

UI Steps

1.    

Configure the map. (This is a first level map.)

a. Select Maps > Maps > Maps.
b. Click New.
c. Type map3 in the Alias field.
d. Select Regular for Type and By Rule for Subtype.
e. Select the network port for Source. For example 1/1/x11
f. Select 1/1/g3 for Destination. This is the IP interface configured in Ex 1, Step 3: Configure the IP Interface with Tool Port and Associate with the Exporter.
g. Click Add a Rule.

Select IP Version.

Set Version to 4.

h. Click Save.
2.  

Display the map configuration.

Click on the row for map3 to display the Quick View for the map.

Example 2: NetFlow Generation Configuration

Starting in software version 4.2, NetFlow exporters can filter NetFlow records. The filtered NetFlow records are sent to the collectors.

In Example 2, there are three exporters, with filtering configured on two of them. Because the second exporter does not have any filtering configured, all the records are sent to the collector. In this example, there are also two tunnels and two maps. Both maps are first level maps.

Ex 2, Step 1: Configure the GigaSMART Group

Configure a GigaSMART group and associate it with a GigaSMART engine port, as follows:

Step

Description

UI Steps

1.    

Configure the GigaSMART Group

a. From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups.
b. Click New.
c. Type grp in the Alias field to identify this GigaSMART Group.
d. Click in the Port List field and select an engine port. For example, 1/5/e1.
e. Click Save.
2.  

Display the information about the GigaSMART Group.

On the GigaSMART Group page, click on the alias gsgp2 to display the GigaSMART Group Quick View.

Ex 2, Step 2: Configure the Exporters

Configure one or more NetFlow Generation Exporter(s), as follows:

Task

Description

UI Steps

1.    

Configure the first exporter.

a. From the device view, select GigaSMART > NetFlow / IPFIX Generation > Exporters.
b. Click New.
c. Set NetFlow Exporter Info
Alias: exp1.
Version: IPFIX
Template Refresh Interval: Use the default
d. Select SNMP
e. Set Transport Configuration.
Transport Protocol: UDP
IP Version: v4
Destination IP: 1.1.1.1
Destination Port: 2055
DSCP: 0
TTL: 64
f. Add Filter Rule 1
Click Add a Rule
Select IPv4 Destination
Enter 1.1.1.1 for the IPv4 Address
Enter 255.255.255.248 for the Net Mask
Select 0.
g. Add Filter Rule 2
Click Add a Rule.
Select VLAN.
Enter 1 for min.
Set Position to 0.
h. Add Filter Rule 3
Click Add a Rule.
Select Port Destination.
Enter 1 for min.
Set Position to 0.
i. Click Save.
2.  

Configure the second exporter.

a. From the device view, select GigaSMART > NetFlow > Exporters.
b. Click New.
c. Set NetFlow Exporter Info
Alias: exp2.
Version: IPFIX
Template Refresh Interval: Use the default
d. Select SNMP
e. Set Transport Configuration.
Transport Protocol: UDP
IP Version: v4
Destination IP: 2.2.2.2
Destination Port: 2055
DSCP: 0
TTL: 64
f. Click Save.
3.  

Configure the third exporter.

a. From the device view, select GigaSMART > NetFlow > Exporters.
b. Click New.
c. Set NetFlow Exporter Info
Alias: exp1.
Version: IPFIX
Template Refresh Interval: Use the default
d. Select SNMP
e. Set Transport Configuration.
Transport Protocol: UDP
IP Version: v4
Destination IP: 3.3.3.3
Destination Port: 2055
DSCP: 0
TTL: 64
f. Add Filter Rule 1
Click Add a Rule
Select IPv4 Destination
Enter 3.3.3.3 for the IPv4 Address
Enter 255.255.255.248 for the Net Mask
Select 0.
g. Add Filter Rule 2
Click Add a Rule.
Select VLAN.
Enter 3 for min.
Set Position to 0.
h. Add Filter Rule 3
Click Add a Rule.
Select Port Destination.
Enter 3 for min.
Set Position to 0.
i. Click Save.

Ex 2, Step 3: Configure the IP Interfaces with Tool Ports and Associate with the Exporters

In this example, create two IP interfaces with tool ports. You must associate these IP interfaces with the NetFlow Exporters in Ex 2, Step 2: Configure the Exporters.

Task

Description

UI Steps

1.    

Identify the collector ports and configure them as a tool ports, where the NetFlow collector will be connected

a. Identify the ports to use as an IP interface with tool port. For example, 1/1/g1 and 1/1/g2.
b. Select Ports > All Ports.
c. Use the Quick Port Editor to configure port 1/1/g1 and 1/1/g2 as tool ports.
d. Click OK.
2.  

Configure the first IP interface.

a. Select Ports > IP Interfaces.
b. Click New.
c. In the Alias and Comment fields, enter the name and description for the IP interface.
d. Select the tool port 1/1/g1 from the Port list.
e. Set the IP address to 1.1.1.1.
f. Set the IP Mask to 255.255.0.0.
g. Set the Gateway address to 3.3.3.3.
h. Set MTU to 2000.
i. Select the GigaSMART Group grp from the GigaSMART Group list.
j. From the Exporters drop-down list, select the first Exporter that you configured.
k. Click OK.
3.  

Configure the second IP interface.

a. Select Ports > IP Interfaces.
b. Click New.
c. In the Alias and Comment fields, enter the name and description of the IP interface.
d. Select the tool port 1/1/g2 from the Port list.
e. Set the IP address to 2.2.2.2.
f. Set the IP Mask to 255.255.255.248.
g. Set the Gateway address to 4.4.4.4.
h. Set MTU to 2000.
i. Select the GigaSMART Group grp from the GigaSMART Group list.
j. From the Exporters drop-down list, select the third Exporter that you configured.
k. Click Save.
4.  

Display the IP interfaces configurations.

Select Ports > IP Interfaces. On the IP Interfaces page, click on the IP interfaces to display the details.

Ex 2, Step 4: Configure the Record

Configure a NetFlow Generation Record, as follows:

Task

Description

UI Steps

1.    

Configure the record.

a. From the device view, select GigaSMART > NetFlow / IPFIX Generation > Records.
b. Click New.
c. Type rec1 in the Alias field.
d. Select IPFIX.
e. Configure Key Fields (Match)
IPv4 TLL
IPv6 Traffic Class
f. Configure Non-Key Fields (Collect)
IPv6 Transport UDP Source Port
IPv6 Transport
Transport TCP Source Port
g. Click Save.
2.  

Display the record configuration.

Click on the row with the Alias rec1 to display the Record Quick View.

Ex 2, Step 5: Configure the Monitor

Configure a NetFlow Generation Monitor and associate the NetFlow Generation Record to the specified NetFlow Generation Monitor, as follows:

Task

Description

UI Step

1.    

Configure the monitor.

Note:  In this example, NetFlow sampling is not enabled.

a. From the device view, select GigaSMART > NetFlow / IPFIX Generation > Records.
b. Click New.
c. Type mon1 in the Alias field.
d. Select rec1 from the Record list.
e. Click Save.
2.  

Display the monitor configuration.

Click on the row with the Alias mon1 to display the Monitor Quick View.

Ex 2, Step 6: Add the Monitor to the GigaSMART Group

Add the monitor created in Ex 1, Step 5: Configure the Monitor to the GigaSMART Group created in step Ex 1, Step 1: Configure the GigaSMART Group.

Note:  Only one NetFlow Generation Monitor can be configured per gsgroup.

Step

Description

UI Steps

1.    

Select the GigaSMART Group configured in Ex 2, Step 1: Configure the GigaSMART Group.

a. From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups.
b. On the GigaSMART Groups page, select gsgp2.
c. Click Edit.
d. Click in the Monitor field and select the NetFlow Monitor created in Ex 2, Step 5: Configure the Monitor
e. Click Save.
2.  

Display the GigaSMART Group information.

a. From the device view, select GigaSMART Groups > GigaSMART Groups.
b. On the GigaSMART Groups page, click on the alias to display the information in a Quick View.

Ex 2, Step 7: Configure the GigaSMART Operation

Define a GigaSMART Operation to enable NetFlow Generation, as follows:

Step

Description

UI Steps

1.    

Configure the GigaSMART Operation and associate it with the GigaSMART Group created in Ex 2, Step 1: Configure the GigaSMART Group

a. From the device view, select GigaSMART > GigaSMART Operations (GSOP) > GigaSMART Operation.
b. Click New.
c. Type an alias in the Alias field to identify this operation. For example, gsop2.
d. For GigaSMART Groups, select grp.
e. For GigaSMART Operations (GSOP), select NetFlow.
f. Click Save.
2.  

Display the configuration GigaSMART Operation.

On the GigaSMART Operations page, click on the alias gsop2 to open the GigaSMART Operation Quick View.

Ex 2, Step 8: Configure Mapping Rules to Filter Packets

To add flow mapping rules to filter packets that are needed to run NetFlow, configure maps and associate the maps to the IP interfaces with tool ports, as follows:

 

Task

Description

UI Steps

1.    

Configure the first map. (This is a first level map.)

a. Select Maps > Maps > Maps.
b. Click New.
c. Type map1 in the Alias field.
d. Select Regular for Type and By Rule for Subtype.
e. Set network ports 1/1/x1 and 1/1/x2 as the Source.
f. Set tool port 1/1/g1 as the Destination.
g. From the device view, select GigaSMART Group for this map from the GSOP list. For example, gsop1.
h. Click Add a Rule.
i. Select IP Version.
j. Set Version to v4.
k. Click Save.
2.  

Configure the second map. (This is also a first level map.)

a. Select Maps > Maps > Maps.
b. Click New.
c. Type map2 in the Alias field.
d. Select Regular for Type and By Rule for Subtype.
e. Set network ports 1/1/x3 and 1/1/x4 as the Source.
f. Set tool port 1/1/g1 as the Destination.
g. From the device view, select GigaSMART Group for this map from the GSOP list. For example, gsop1.
h. Click Add a Rule.
i. Select Pass
j. Select IP Version.
k. Set Version to v4.
l. Click Save.
3.  

Display the map configuration.

a. Select Table View.
b. Select alias of the port to see the Quick View for the port.

Example 3: NetFlow Generation Configuration

Starting in software version 4.3.01, NetFlow supports both first level and second level maps. In Example 3, there are two maps. However, unlike Example 2, which has two first level maps, in this example, one map is a first level map and the other is a second level map. A virtual port is configured that directs traffic to the second level map.

The configuration of the GigaSMART operation in Example 3 differs from Example 1 and Example 2. The GigaSMART Operation sends traffic to APF first, and then to NetFlow.

In the first level map, the traffic matching the rule is sent to the virtual port. The same traffic is also sent to two tool ports (2/1/g2 and 2/1/g3).

In the second level map, the traffic from the virtual port matching the gsrule is sent to NetFlow and then to the IP interface with tool port, 2/1/g7.

Ex 3, Step 1: Configure the GigaSMART Group

Configure a GigaSMART group and associate it with a GigaSMART engine port, as follows:

Step

Description

UI Steps

1.    

Configure the GigaSMART Group

a. From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups.
b. Click New.
c. Type grp in the Alias field to identify this GigaSMART Group.
d. Click in the Port List field and select an engine port. For example, 1/5/e1.
e. Click Save.
2.  

Display the information about the GigaSMART Group.

On the GigaSMART Group page, click on the alias gsgp2 to display the GigaSMART Group Quick View.

Ex 3, Step 2: Configure IP Interface and Associate with Exporter

Configure the IP interface and associate with the NetFlow Generation Exporter, as follows:

Task

Description

UI Steps

 

Configure the IP interface.

a. Select Ports > IP Interfaces
b. Click New.
c. In the Alias and Comment fields, enter the name and description of the IP interface.
d. Click in the Port field and select the tool port 1/1/g7.
e. Set the IP address to 10.115.9.5.
f. Set the IP Mask to 255.255.248.0.
g. Set the Gateway address to 10.115.8.1.
h. Set MTU to 1500.
i. Select the GigaSMART Group created in Ex 3, Step 1: Configure the GigaSMART Group.
j. From the Exporters drop-down list, select exp1.
k. Click OK.

Ex 3, Step 3: Configure IP Interface with Tool Port

Create an IP interface with tool port.

Step

Description

UI Steps

1.    

Identify the collector port and configure it as a tool port, where the NetFlow collector will be connected.

a. Identify the port to use as an IP interface with tool port. For example, 1/1/g7.
b. Select Ports > All Ports.
c. Use the Quick Port Editor to configure port 1/1/g3 as tool port.
2.  

Configure the IP interface. The IP address is for the NetFlow interface.

a. Select Ports > IP Interfaces.
b. Click New.
c. In the Alias and Comment fields, enter the name and description of the IP interface.
d. Click in the Port field and select port 1/1/g3.
e. Enter 10.115.9.5 in the IP Address field.
f. Enter 255.255.255.255 in the Mask field
g. Enter 10.115.9.1 in the Gateway field.
h. Enter 1500 in the MTU field.
i. Select the GigaSMART Group created in Ex 1, Step 1: Configure the GigaSMART Group.
j. Click Save.
3.  

Display the IP interface configuration.

a. Select Ports > IP Interfaces.
b. Click on the row for port 1/1/g7 to display the IP Interfaces details in a Quick View.

Ex 3, Step 4: Configure Record

Configure a NetFlow Generation Record, as follows:

 

Description

UI Steps

 

Configure the record.

a. From the device view, select GigaSMART > NetFlow > Records.
b. Click New.
c. Type rec1 in the Alias field.
d. Select IPFIX.
e. Configure Key Fields (Match)

Select TOS.

Select IPv4 and enable Source.

Select Address.

f. Configure Non-Key Fields (Collect)

Select IPv4 and enable Source.

Select Interface.

g. Click Save.

Ex 3, Step 5: Configure the Monitor

Configure a NetFlow Generation Monitor and associate the NetFlow Generation Record to the specified NetFlow Generation Monitor, as follows:

 

Description

UI Steps

 

Configure the monitor.

a. From the device view, select GigaSMART > NetFlow > Records.
b. Click New.
c. Type mon1 in the Alias field.
d. Select rec1 from the Record list.
e. Click Save.

Ex 3, Step 6: Add the Monitor to the GigaSMART Group

Add the monitor created in Ex 3, Step 5: Configure the Monitor to the GigaSMART Group created in step Ex 3, Step 1: Configure the GigaSMART Group.

Note:  Only one NetFlow Generation Monitor can be configured per gsgroup.

Step

Description

UI Steps

1.    

Select the GigaSMART Group configured in Ex 3, Step 1: Configure the GigaSMART Group.

a. From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups.
b. On the GigaSMART Groups page, select grp.
c. Click Edit.
d. Click in the Monitor field and select the NetFlow Monitor created in Ex 3, Step 5: Configure the Monitor
e. Click Save.
2.  

Display the GigaSMART Group information.

a. From the device view, select GigaSMART Groups > GigaSMART Groups.
b. On the GigaSMART Groups page, click on the alias to display the information in a Quick View.

Ex 3, Step 7: Configure the GigaSMART Operation

Define a GigaSMART Operation to enable NetFlow Generation, as follows:

Step

Description

UI Steps

1.    

Configure the GigaSMART Operation and associate it with the GigaSMART Group created in Ex 3, Step 1: Configure the GigaSMART Group

a. From the device view, select GigaSMART > GigaSMART Operations (GSOP) > GigaSMART Operation.
b. Click New.
c. Type an alias in the Alias field to identify this operation. For example, gsop2.
d. For GigaSMART Groups, select grp.
e. For GigaSMART Operations (GSOP), select NetFlow.
f. Click Save.
2.  

Display the configuration GigaSMART Operation.

On the GigaSMART Operations page, click on the alias gsop2 to open the GigaSMART Operation Quick View.

Ex 3, Step 8: Configure the Virtual Port

For the second level map that you will create in Ex 3, Step 9: Configure Mapping Rules to Filter Packets, you will need to create a virtual port.

Configure a virtual port and associate it with the GigaSMART group, as follows:

Step

Description

UI Steps

1.    

Configure the virtual port for the second level map.

a. From the device view, select GigaSMART > Virtual Ports.
b. On the GigaSMART Groups page, select grp.
c. Click New.
d. Type an alias for the virtual port in the Alias field. For example, vp1.
e. Click in the GigaSMART Group filed and select the GigaSMART Group created in Ex 3, Step 1: Configure the GigaSMART Group.
f. Click Save.
2.  

Display the virtual port information.

a. From the device view, select GigaSMART Groups > Virtual Ports.
b. On the Virtual Ports page, click on the virtual port alias to display the information in a Quick View.

Ex 3, Step 9: Configure Mapping Rules to Filter Packets

To add flow mapping rules to filter packets that are needed to run NetFlow, configure maps and associate the maps to the IP interface with tool port, as follows:

 

Task

Description

UI Steps

1.    

Configure the first map. (This is a first level map.)

a. Select Maps > Maps > Maps.
b. Click New.
c. Type map1 in the Alias field.
d. Select First Level for Type and By Rule for Subtype.
e. Set network port 1/1/g1 as the Source.
f. Set virtual port v1 and tool ports 21/1/g2 and 2/1/g3 as the Destination.
g. Click Add a Rule.
h. Select Pass
i. Select MAC Destination.
j. Set the MAC address and mask to 00:00:00:00:00:00
k. Click Save.
2.  

Configure the second map. (This is a second level map.)

a. Select Maps > Maps > Maps.
b. Click New.
c. Type map2 in the Alias field.
d. Select Second Level for Type and By Rule for Subtype.
e. Set virtual port v1 as the Source.
f. Set tool port v1 2/1/g7 as the Destination.
g. Select gsop_apf_netflow from the GSOP list.
h. Click Add a Rule.
i. Select Pass
j. Select MAC Destination.
k. Set the MAC address and mask to 00:00:00:00:00:00
l. Click Save.

Example 4: NetFlow Generation Configuration

Starting in software version 4.3.01, NetFlow supports both first level and second level maps. In Example 4, there are three maps. One map is a first level map and the other two are second level maps. Two virtual ports are configured that direct traffic to the second level maps.

Two GigaSMART operations are configured. One gsop sends traffic to masking. The other gsop sends traffic to APF and then to NetFlow.

In the first level map, the traffic matching the rule is sent to two virtual ports. The same traffic is also sent to a tool port (11/1/g3).

In the first second level map, the traffic from the first virtual port, vp1, that matches the gsrule, is sent to masking and then to the tool port 11/1/g2.

In the next second level map, the traffic from the second virtual port, vp2, that matches the gsrule, is sent to NetFlow and then to the IP interface with tool port, 11/1/g4.

Ex 4, Step 1: Configure the GigaSMART Group

Configure two GigaSMART groups and associate them with a GigaSMART engine port, as follows:

Step

Description

UI Steps

1.    

Configure the first GigaSMART Group.

a. From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups.
b. Click New.
c. Type an grp1 in the Alias field to identify this GigaSMART Group.
d. Click in the Port List field and select an engine port. For example, 1/5/e1.
e. Click Save.
2.  

Configure the second GigaSMART Group

a. From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups.
b. Click New.
c. Type an grp2 in the Alias field to identify this GigaSMART Group.
d. Click in the Port List field and select an engine port. For example, 1/5/e1.
e. Click Save.
3.  

Display the information about the GigaSMART Group.

On the GigaSMART Group page, click on the alias gsgp2 to display the GigaSMART Group Quick View.

Ex 4, Step 2: Configure the IP Interface with Tool Port

Create an IP interface with tool port. You must associated this IP interface with the NetFlow Exporter in Ex 4, Step 3: Configure the IP Interface and Associate with Exporter.

Step

Description

UI Steps

1.    

Identify the collector port and configure it as a tool port, where the NetFlow collector will be connected.

a. Identify the port to use as an IP interface with tool port. For example, 1/1/g3.
b. Select Ports > All Ports.
c. Use the Quick Port Editor to configure port 1/1/g3 as tool port.
2.  

Configure the IP interface. The IP address is for the NetFlow interface.

a. Select Ports > IP Interfaces.
b. Click New.
c. In the Alias and Comment fields, enter the name and description of the IP interface.
d. Click in the Port field and select port 1/1/g3.
e. Enter 10.10.10.10 in the IP Address field.
f. Enter 255.255.255.255 in the Mask field
g. Enter 10.10.10.1 in the Gateway field.
h. Enter 1500 in the MTU field.
i. Select the GigaSMART Group grp2 created in Ex 4, Step 1: Configure the GigaSMART Group.
j. Click Save.
3.  

Display the IP interfaces configuration.

a. Select Ports > IP Interfaces.
b. Click on the row for port 1/1/g3 to display the details in a Quick View.

Ex 4, Step 3: Configure the IP Interface and Associate with Exporter

Configure the IP interface and associate the NetFlow Generation Exporter, as follows:

 

Description

Command

 

Configure the IP interface.

a. Select Ports > IP Interfaces.
b. Click New.
c. In the Alias and Comment fields, enter the name and description of the IP interface.
d. Click in the Port field and select the IP interface configured in Ex 4, Step 2: Configure the IP Interface with Tool Port.
e. Set the IP address to 10.115.9.6.
f. Set the IP Mask to 255.255.248.0.
g. Set the Gateway address to 10.115.8.1.
h. Set MTU to 1500.
i. Select the GigaSMART Group grp2 from the GigaSMART Group list.
j. From the Exporter drop-down list, select ex21.
k. Click Save.

Ex 4, Step 4: Configure the Record

Configure a NetFlow Generation Record, as follows:

 

Description

UI Steps

 

Configure the record.

a. From the device view, select GigaSMART > NetFlow / IPFIX Generation > Records.
b. Click New.
c. Type rec1 in the Alias field.
d. Select IPFIX.
e. Configure Key Fields (Match)

Select IPV4

Select TOS and then select Source.

f. Configure Non-Key Fields (Collect)

Select IPv4 and then select Protocol and Source

Select Interface

g. Click Save.

Ex 4, Step 5: Configure the Monitor

Configure a NetFlow Generation Monitor and associate the NetFlow Generation Record to the specified NetFlow Generation Monitor, as follows:

 

Description

Command

 

Configure the monitor.

a. From the device view, select GigaSMART > NetFlow / IPFIX Generation > Records.
b. Click New.
c. Type mon1 in the Alias field.
d. Select Normal for Cache Type.
e. Set Cache Timeout Active to 2.
f. Set Cache Timeout Inactive to 2
g. Select rec1 from the Record list.
h. Click Save.

Ex 4, Step 6: Add the Monitor to the GigaSMART Group

Add the monitor created in Ex 4, Step 5: Configure the Monitor to the GigaSMART Group created in step Ex 4, Step 1: Configure the GigaSMART Group.

Note:  Only one NetFlow Generation Monitor can be configured per gsgroup.

Step

Description

UI Steps

1.    

Select the GigaSMART Group configured in Ex 4, Step 1: Configure the GigaSMART Group.

a. From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups.
b. On the GigaSMART Groups page, select grp2.
c. Click Edit.
d. Click in the Monitor field and select the NetFlow Monitor created in Ex 4, Step 5: Configure the Monitor
e. Click Save.
2.  

Display the GigaSMART Group information.

a. From the device view, select GigaSMART Groups > GigaSMART Groups.
b. On the GigaSMART Groups page, click on the alias grp2 to display the information in a Quick View.

Ex 4, Step 7: Configure the GigaSMART Operation

Define the two GigaSMART operation to enable masking and NetFlow, as follows:

Step

Description

UI Steps

1.    

Configure the first GigaSMART Operation for APF and masking

a. From the device view, select GigaSMART > GigaSMART Operations (GSOP) > GigaSMART Operation.
b. Click New.
c. Type gsop_mask_aa in the Alias field
d. For the GigaSMART Group, select grp.
e. Click in th GigaSMART Operations (GSOP) field and select Adaptive Packet Filtering.
f. Click in th GigaSMART Operations (GSOP) field and select Masking. Set Masking as follows:

Protocol: None

Offset: 50

Pattern: aa.

Length: 100

g. Click Save.
2.  

Configure the second GigaSMART Operation for NetFlow

a. From the device view, select GigaSMART > GigaSMART Operations (GSOP) > GigaSMART Operation.
b. Click New.
c. Type an alias in the Alias field to identify this operation. For example, gsop2.
d. For GigaSMART Group, select grp
e. For GigaSMART Operations (GSOP), select NetFlow.
f. Click Save.
3.  

Display the configuration GigaSMART Operation.

On the GigaSMART Operations page, click on the alias gsop2 to open the GigaSMART Operation Quick View.

Ex 4, Step 8: Configure the Virtual Port

For the second level map that you will create in Ex 4, Step 9: Configure Mapping Rules to Filter Packets, you will need to create virtual ports.

Configure a virtual port and associate it with the GigaSMART group, as follows:

Step

Description

UI Steps

1.  

Configure the first virtual port for the second level map.

a. From the device view, select GigaSMART > Virtual Ports.
b. On the GigaSMART Groups page, select grp.
c. Click New.
d. Type vp1 n the Alias field.
e. Click in the GigaSMART Group field and select grp1.
f. Click Save.
7.  

Configure the second virtual port for the second level map.

a. From the device view, select GigaSMART > Virtual Ports.
b. On the GigaSMART Groups page, select grp.
c. Click New.
d. Type vp2 in the Alias field.
e. Click in the GigaSMART Group field and select the grp2.
f. Click Save.
4.  

Display the virtual port information.

a. From the device view, select GigaSMART Groups > Virtual Ports.
b. On the Virtual Ports page, click on the virtual port alias to display the information in a Quick View.

Ex 4, Step 9: Configure Mapping Rules to Filter Packets

To add flow mapping rules to filter packets that are needed to run NetFlow, configure maps and associate the maps to the IP interfaces with tool ports, as follows:

 

Task

Description

UI Steps

1.    

Configure the first map. (This is a first level map.)

a. Select Maps > Maps > Maps.
b. Click New.
c. Type map1 in the Alias field.
d. Select First Level for Type and By Rule for Subtype.
e. Set network port 11/1/g1 as the Source.
f. Set virtual ports v1 and v2 plus tool port 1/1/g3 as the Destination.
g. Click Add a Rule.
h. Select Pass
i. Select MAC Destination.
j. Set the MAC address and mask to 00:00:00:00:00:00
k. Click Save.
2.  

Configure the second map. (This is a second level map.)

a. Select Maps > Maps > Maps.
b. Click New.
c. Type map2 in the Alias field.
d. Select Second Level for Type and By Rule for Subtype.
e. Set virtual port v1 as the Source.
f. Set tool port v1 11/1/g2 as the Destination.
g. Select gsop_mask_aa from the GSOP list.
h. Click Add a Rule.
i. Select Pass
j. Select MAC Destination.
k. Set the MAC address and mask to 00:00:00:00:00:00
l. Click Save.
3.  

Configure the third map. (This is also a second level map.)

a. Select Maps > Maps > Maps.
b. Click New.
c. Type map2 in the Alias field.
d. Select Second Level for Type and By Rule for Subtype.
e. Set virtual port v2 as the Source.
f. Set tool port v1 11/1/g4 as the Destination.
g. Select gsop_apf_netflow from the GSOP list.
h. Click Add a Rule.
i. Select Pass
j. Select MAC Destination.
k. Set the MAC address and mask to 00:00:00:00:00:00
l. Click Save.

Display Exporter Statistics

To display exporter statistics, select GigaSMART > GigaSMART Operations (GSOP) > Statistics and open the GigaSMART Statistics Quick View to view the NetFlow Statistics.

Refer to NetFlow Exporter Statistics Definitions for descriptions of the statistics.

Display Monitor Statistics

To display exporter statistics, select GigaSMART > GigaSMART Operations (GSOP) > Statistics and open the GigaSMART Statistics Quick View to view the NetFlow Statistics.

Refer to NetFlow Monitor Statistics Definitions for descriptions of these statistics.

Display IP Interfaces Statistics

To display IP interfaces statistics, select Ports > IP Interfaces > Statistics and look for the IP interface ID in the statistics table.

Refer to IP Interfaces Statistics Definitions for descriptions of these statistics.

NetFlow Generation Configuration Modification and Removal

There may be instances where a NetFlow Generation configuration may require alteration by modifying a NetFlow Generation Monitor Configuration or a NetFlow Generation Record Configuration. It may further require that the configuration be removed entirely. In such instances, refer to the following.

Modify NetFlow Generation Monitor Configuration

This example shows the modification of a NetFlow Generation Monitor configuration.

1.   Unlink the monitor from GigaSMART Parameters.
a. From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups.
b. Select the GigaSMART group to modify.
c. Click Edit.
d. Under NetFlow, select None in the Monitor field.
e. Click Save.
2. Modify the monitor parameters.
a. From the device view, select GigaSMART > NetFlow / IPFIX Generation > Monitors.
b. Select the Monitor to modify.
c. Click Edit.
d. Under Config, modify the monitor parameters.
e. Select the record from the Record(s) list to re-add it to the monitor.
3. Re-add the monitor to GigaSMART Parameters for the changes to take affect.
a. From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups.
b. Select the GigaSMART group to modify.
c. Click Edit.
d. Under NetFlow, select the monitor in the Monitor field.
e. Click Save.

Modify NetFlow Generation Record Configuration

This example shows the modification of a NetFlow Generation Record configuration.

1.   Unlink the monitor from gsparams.
a. From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups.
b. Select the GigaSMART group to modify.
c. Click Edit.
d. Under NetFlow, select None in the Monitor field.
e. Click Save.
2. Modify the record bound to the monitor.
a. From the device view, select GigaSMART > NetFlow / IPFIX Generation > Records.
b. Select the record to modify.
c. Click Edit.
d. Modify the record configuration.
3. Re-add the monitor to the GigaSMART Parameters for changes in record to take affect.
a. From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups.
b. Select the GigaSMART group to modify.
c. Click Edit.
d. Under NetFlow, select the monitor in the Monitor field.
e. Click Save.

Remove NetFlow Generation Configuration

Use the following steps to remove a NetFlow Generation Configuration:

1.   Remove the NetFlow parameter from the GigaSMART Group.
a. From the device view, select GigaSMART > GigaSMART Groups > GigaSMART Groups.
b. Select the GigaSMART Group.
c. Click Edit.
d. Under NetFlow, select None in the Monitor field.
2. Delete the Maps.
a. Select Maps > Maps > Maps.
b. Select Table View.
c. Select the Maps.
d. Click Delete.
3. Delete the IP interface.
a. Select Ports > IP Interfaces.
b. Select the port.
c. Click Delete.
4. Delete the monitor, records, and exporter
a. From the device view, select GigaSMART > NetFlow / IPFIX Generation > Monitors.
b. Select the monitor, and then click Delete.
c. Select Records
d. Select the record, and then click Delete
e. Select Records.
f. Select the record, and then click Delete.

V5 Fixed Record Template

NetFlow v5 records have a template of fixed fields that cannot be edited. The template contains Match/Key and Collect/Non-Key elements. It has an alias of predefined_netflow_v5_record.

To display the template, select GigaSMART > NetFlow / IPFIX Generation > Records and click on predefined_netflow_v5_record to display the Record Quick View shown in Figure 9: NetFlow Record predefined_netflow_v5_record.

Figure 89 NetFlow Record predefined_netflow_v5_record

NetFlow Generation Match/Key and Collect/Non-Key Elements

NetFlow v9 and IPFIX records allow the user to configure Match/Key and Collect/Non-Key elements.

Match/Key Syntax

NetFlow v9 and IPFIX records allow the you to configure Match/Key elements.

Note:  NetFlow v9 does not support Match/Key elements whose ID on the specified link is greater than 128. For additional information, refer to the following:

http://www.iana.org/assignments/ipfix/ipfix.xhtml

To configure the Match/Key elements, click in the Key Fields (Match) field in the NetFlow Record configuration page and select the match type.

The supported combinations of Match/Key elements are outlined in the following table:

 

Match Type

Parameters

 

 

Description

Data Link

Source Mac

 

 

Supported for v9 and IPFIX.

 

Destination

 

 

Supported for v9 and IPFIX.

 

VLAN

 

 

Supported for v9 and IPFIX.

Interface

Input physical

Physical Width-2

Physical Width-4

 

Supported for v9 and IPFIX. for width, the only supported values are 2 or 4.

IPv4

Destination

Address

 

Configures the IPv4 destination address as a key field.

Supported for v9 and IPFIX.

 

 

Prefix

<netmask | mask_length>

Configures a prefix for the IPv4 destination address as a key field.

Supported for v9 and IPFIX.

 

DSCP

 

 

Supported only for IPFIX.

 

Fragmentation Flags

 

 

Supported only for IPFIX.

 

Fragmentation ID

 

 

Supported for v9 and IPFIX.

 

Fragmentation Offset

 

 

Supported for v9 and IPFIX.

 

Header Length

 

 

Supported only for IPFIX.

 

Option Map

 

 

Supported only for IPFIX.

 

Precedence

 

 

Supported only for IPFIX.

 

Protocol

 

 

Supported for v9 and IPFIX.

 

Section

Header Size

<size>

Configures the number of bytes of raw data starting at the IPv4 header, to use as a key field. The range is from 1 to 128. Supported only for IPFIX.

 

 

Payload Size

<size>

Configures the number of bytes of raw data starting at the IPv4 payload, to use as a key field. The range is from 1 to 128. Supported only for IPFIX.

 

Source

Address

 

Supported for v9 and IPFIX.

 

 

Prefix

<netmask | mask_length>

Supported for v9 and IPFIX.

 

TOS

 

 

Supported only for IPFIX.

 

Total Length

maximum | minimum

 

Supported only for IPFIX.

 

TTL

 

 

Supported only for IPFIX.

 

Version

 

 

Supported for v9 and IPFIX.

IPv6

Destination

Address

 

Supported for v9 and IPFIX.

 

 

Prefix

<netmask | mask_length>

Supported only for IPFIX.

 

DSCP

 

 

Supported only for IPFIX.

 

Extension Map

 

 

Supported for v9 and IPFIX.

 

Flow Label

 

 

Supported for v9 and IPFIX.

 

Fragmentation Flags

 

 

Supported only for IPFIX.

 

Fragmentation ID

 

 

Supported for v9 and IPFIX.

 

Fragmentation Offset

 

 

Supported for v9 and IPFIX.

 

Hop Limit

 

 

Supported only for IPFIX.

 

Length

Header

 

Supported only for IPFIX.

 

 

Payload

 

Supported only for IPFIX.

 

 

Total

 

Supported only for IPFIX.

 

Next Header

 

 

Supported only for IPFIX.

 

payload-length

 

 

Supported only for IPFIX.

 

Precedence

 

 

Supported only for IPFIX.

 

Protocol

 

 

Supported for v9 and IPFIX.

 

Section

Header Size

<size>

Supported only for IPFIX. The range is from 1 to 128.

 

 

Payload Size

<size>

Supported only for IPFIX. The range is from 1 to 128.

 

Source

Address

 

Supported for v9 and IPFIX.

 

 

Prefix

<netmask | mask_length>

Supported only for IPFIX.

 

Traffic Class

 

 

Supported for v9 and IPFIX.

 

Version

 

 

Supported for v9 and IPFIX.

Transport

Destination Port

 

 

Supported for v9 and IPFIX.

 

ICMP

IPv4

Code

Supported only for IPFIX.

 

 

 

Type

Supported only for IPFIX.

 

 

IPv6

Code

Supported only for IPFIX.

 

 

 

Type

Supported only for IPFIX.

 

Source Port

 

 

Supported for v9 and IPFIX.

 

TCP

ACK Number

 

Supported only for IPFIX.

 

 

Destination Port

 

Supported only for IPFIX.

 

 

Flags <enable | disable>

[ACK] | [CWR] | [ECE] | [FIN] | [PSH] | [RST] | [SYN] | [URG]

Supported only for v9 and IPFIX.

 

 

Header Length

 

Supported only for IPFIX.

 

 

Sequence Number

 

Supported only for IPFIX.

 

 

Source Port

 

Supported only for IPFIX.

 

 

Urgent Pointer

 

Supported only for IPFIX.

 

 

window-size

 

Supported only for IPFIX.

 

UDP

Destination Port

 

Supported only for IPFIX.

 

 

Message Length

 

Supported only for IPFIX.

 

 

Source Port

 

Supported only for IPFIX.

Collect/Non-Key Syntax

NetFlow v9 and IPFIX records allow the user to configure Collect/Non-Key elements.

The number of Collect/Non-Key elements in a record can be up to 32. Each Collect/Non-Key element has a size. The accumulated size of the Collect/Non-Key elements in the record cannot exceed 1024 bytes. The supported Collect/Non-Key elements is determined either by the maximum number of elements in a record (32) or by the maximum size (1024 bytes), whichever is reached first.

Note:  NetFlow v9 does not support Collect/Non-Key elements whose ID on the specified link is greater than 128. For additional information, refer to the following:

http://www.iana.org/assignments/ipfix/ipfix.xhtml

To configure the Collect/Non-Key elements, click in the Non-Key Fields (Collect) field in the NetFlow Record configuration page and select the match type.

The supported combinations of Collect/Non-Key elements are outlined in the following table:

 

Collect Type

Parameters

Size

 

Description

Counter

Bytes

32

64

 

Supported for v9 and IPFIX.

 

Packets

32

64

 

Supported for v9 and IPFIX.

Datalink

Source

 

 

Supported for v9 and IPFIX.

 

Mac Destination

 

 

Supported for v9 and IPFIX.

 

VLAN

 

 

Supported for v9 and IPFIX.

Flow

End Reason

 

 

Supported only for IPFIX.

Interface

Input Name

Input Width

[width]

Supported for v9 and IPFIX. for width, the range is from 1 to 32.

 

Physical

Physical Width-2

Physical Width-4

 

Supported for v9 and IPFIX. For width, the only supported values are 2 or 4.

 

Output

Physical Width-2

Physical Width-4

 

Supported for v9 and IPFIX. For width, the only supported values are 2 or 4.

IPv4

Destination

Address

 

Configures the IPv4 destination address as a non-key field. Supported for v9 and IPFIX.

 

 

Prefix

<netmask | mask_length>

Supported for v9 and IPFIX.

 

DSCP

 

 

Supported only for IPFIX.

 

Fragmentation Flags

 

 

Supported only for IPFIX.

 

Fragmentation ID

 

 

Supported for v9 and IPFIX.

 

Offset

 

 

Supported for v9 and IPFIX.

 

Header Length

 

 

Supported only for IPFIX.

 

Option Map

 

 

Supported only for IPFIX.

 

Precedence

 

 

Supported only for IPFIX.

 

Protocol

 

 

Supported for v9 and IPFIX.

 

Section

Header Size

<size>

Configures the number of bytes of raw data starting at the IPv4 header, to use as a key field. The range is from 1 to 128. Supported for v9 and IPFIX.

 

 

Payload Size

<size>

Configures the number of bytes of raw data starting at the IPv4 payload to use as a key field. The range is from 1 to 128. Supported for v9 and IPFIX.

 

Source

Address

 

Supported for v9 and IPFIX.

 

 

Prefix

<netmask | mask_length>

Configures a prefix for the IPv4 destination address as a non-key field. Supported for v9 and IPFIX.

 

TOS

 

 

Supported only for IPFIX.

 

Total Length

[maximum]

 

Supported only for IPFIX.

 

 

[minimum]

 

Supported only for IPFIX.

 

TTL

 

 

Supported only for IPFIX.

 

Version

 

 

Supported for v9 and IPFIX.

IPv6

Destination

Address

 

Supported for v9 and IPFIX.

 

 

Prefix

<netmask | mask_length>

Supported only for IPFIX.

 

DSCP

 

 

Supported only for IPFIX.

 

Extension Map

 

 

Supported for v9 and IPFIX.

 

Flow Label

 

 

Supported for v9 and IPFIX.

 

Fragmentation Flags

 

 

Supported only for IPFIX.

 

Fragmentation ID

 

 

Supported for v9 and IPFIX.

 

Fragmentation Offset

 

 

Supported for v9 and IPFIX.

 

Hop Limit

[maximum]

 

Supported only for IPFIX.

 

 

[minimum]

 

Supported only for IPFIX.

 

Length

Header

 

Supported for v9 and IPFIX.

 

 

Payload

 

Supported only for IPFIX.

 

 

Total

[maximum]

Supported only for IPFIX.

 

 

 

[minimum]

Supported only for IPFIX.

 

Next Header

 

 

Supported only for IPFIX.

 

Precedence

 

 

Supported only for IPFIX.

 

Protocol

 

 

Supported for v9 and IPFIX.

 

Section

Header Size

<size>

Supported only for IPFIX. The range is from 1 to 128.

 

 

Payload Size

<size>

Supported only for IPFIX. The range is from 1 to 128.

 

Source

Address

 

Supported for v9 and IPFIX.

 

 

Prefix

<netmask | mask_length>

Configures a prefix for the IPv4 destination address as a non-key field. Supported only for IPFIX.

 

Traffic Class

 

 

Supported for v9 and IPFIX.

 

Version

 

 

Supported for v9 and IPFIX.

Private

PEN <pen name>

DNS

<additional-class [number-of-collects <1-10>] |
additional-class-text [number-of-collects <1-10>] |
additional-name [number-of-collects <1-10>] |
additional-rd-length [number-of-collects <1-10>] |
additional-rdata [number-of-collects <1-10> | width <1-128>] |
additional-ttl [number-of-collects <1-10>] |
additional-type [number-of-collects <1-10>] |
additional-type-text [number-of-collects <1-10>] |
an-count | ar-count |
authority-class [number-of-collects <1-10>] |
authority-class-text [number-of-collects <1-10>] |
authority-name [number-of-collects <1-10>] |
authority-rd-length [number-of-collects <1-10>] |
authority-rdata [number-of-collects <1-10> | width <1-128>] |
authority-ttl [number-of-collects <1-10>] |
authority-type [number-of-collects <1-10>] |
authority-type-text [number-of-collects <1-10>] |
bits | identifier | ns-count | op-code | qd-count |
query-class [number-of-collects <1-10>] |
query-class-text [number-of-collects <1-10>] |
query-name [number-of-collects <1-10>] |
query-type [number-of-collects <1-10>] |

Supported only for IPFIX.

Private

(continued)

PEN <pen name>

DNS

query-type-text [number-of-collects <1-10>] |
response-class [number-of-collects <1-10>] |
response-class-text [number-of-collects <1-10>] |
response-code |
response-ipv4-addr [number-of-collects <1-10>] |
response-ipv4-addr-text [number-of-collects <1-10>] | response-ipv6-addr [number-of-collects <1-10>] |
response-ipv6-addr-text [number-of-collects <1-10>] |
response-name [number-of-collects <1-10>] |
response-rd-length [number-of-collects <1-10>] |
response-rdata [number-of-collects <1-10> | width <1-128>] |
response-ttl [number-of-collects <1-10>] |
response-type [number-of-collects <1-10>] |
response-type-text [number-of-collects <1-10>]>

Supported only for IPFIX.

Private

PEN <pen name>

HTTP

Response Code

Supported only for IPFIX.

Private

PEN <pen name>

HTTP

URL

Supported only for IPFIX. For width, the range is from 1 to 250.

Private

PEN <pen name>

HTTP

User Agent

Supported only for IPFIX. For width, the range is from 1 to 250.

Private

PEN <pen name>

SSL Certificate

<Issuer [width] |
Issuer Common Name [width] |
Serial Number |
Serial Number Text | Signature Algorithm |
Signature Algorithm Text |
Subject [width] |
Subject Algorithm |
Subject Algorithm Text |
Subject Alternative Name [width] |
Subject Common Name | [width] |
Subject Key Size |
Valid Not After |
Valid Not After Text |
Valid Not Before |
Valid Not Before Text>

Supported only for IPFIX. For width of Issuer and Subject, the range is from 1 to 250. For width of Issuer Common Name, Subject Alternative Name, and Subject Common Name, the range is from 1 to 64.

Private

PEN <pen name>

SSL Server

<Cipher |
Cipher Text |
Compression Method |
Name Indication [width] |
Session ID |
Version |
Version Text>

Supported only for IPFIX. For width, the range is from 1 to 64.

Private

PEN <pen name>

URL

[width]

Supported only for IPFIX. For width, the range is from 1 to 250.

timestamp

Sys-uptime First

 

 

Supported for v9 and IPFIX.

 

Sys-uptime First Last

 

 

Supported for v9 and IPFIX.

transport

Destination Port

 

 

Supported for v9 and IPFIX.

 

ICMP

IPv4 Code

 

Supported only for IPFIX.

 

 

IPv4 Code Type

 

Supported only for IPFIX.

 

 

ipv6 Code

 

Supported only for IPFIX.

 

 

ipv6 Type

 

Supported only for IPFIX.

 

Source Port

 

 

Supported for v9 and IPFIX.

 

TCP Flags

[ACK] | [CWR] | [ECE] | [FIN] | [PSH] | [RST] | [SYN] | [URG]

 

Supported for v9 and IPFIX.

 

TCP

ACK Number

 

Supported only for IPFIX.

 

 

Destination Port

 

Supported only for IPFIX.

 

 

Header Length

 

Supported only for IPFIX.

 

 

Sequence Number

 

Supported only for IPFIX.

 

 

Source Port

 

Supported only for IPFIX.

 

 

Urgent Pointer

 

Supported only for IPFIX.

 

 

Window Size

 

Supported only for IPFIX.

 

UDP

Destination Port

 

Supported only for IPFIX.

 

 

Message Length

 

Supported only for IPFIX.

 

 

Source Port

 

Supported only for IPFIX.

NetFlow Cacheless export using TCP protocol

Classic NetFlow operates in a cacheless mode and exports packets using TCP protocol. NetFlow monitor enables you to set the cache timeout to zero and makes the NetFlow to operate in a cacheless mode. Each packet received by the NetFlow is treated as a complete flow and the metadata extracted from the packet are immediately exported without caching the flow.

The two main advantages of a cacheless mode are as follows:

When NetFlow operates in a cacheless mode, the NetFlow sends metadata for every incoming packet, hence the number of flows are equal to the number of incoming packets.

For NetFlow to export packets in TCP, you should Configure Apps Exporter, which is also used by 3GPP CUPS and Tunneling.

 

Rules and Notes

For more information about the commands, refer to GigaVUE-OS-CLI Reference Guide.