Quick Start: Installing and Using FlowCollector

This chapter describes how to install FlowCollector and get it running quickly without having to learn anything about how FlowCollector operates.

Note This chapter is intended for network administrators, operators, and managers who are confident of their UNIX system administration and Cisco IOS software configuration skills. The procedures do not explain the background information behind the steps.

The remaining chapters in this guide are for users who want to learn more about FlowCollector and its operations. If you want more instruction and information as you install and operate FlowCollector, skip this quick start chapter and proceed to Chapter 2, which is an overview of NetFlow Services and FlowCollector.

This chapter includes a minimal set of procedures on the following topics:

Process Overview

In this chapter, you will install FlowCollector in its default configuration, meaning that it runs according to predetermined resource definitions and parameter settings that allow it to capture a general range of NetFlow data export traffic statistics.

After you see FlowCollector in action and develop a better understanding of how it collects and aggregates data, you can choose your own aggregation schemes, define filters and protocols, and tune FlowCollector operating parameters according to your own needs. For information on customizing and tuning FlowCollector operation, refer to the chapter "Customizing FlowCollector," later in this guide.

Note Except for descriptions requiring references to specific router or switch platforms, the remainder of this chapter and the remaining chapters of this guide use the term export device in place of the terms router and switch.

Enabling NetFlow Data Export

Because of the configuration differences between routers and switches, any detailed configuration description for either type of NetFlow export device is beyond the scope of this guide. At the broadest conceptual level, you need to perform the following types of configuration tasks on the export devices:

Enable NetFlow services on Cisco 7200 series routers and on Cisco 7000 and 7500 series routers with a Route Switch Processor (RSP); enable Multilayer Switching (MLS) on Catalyst 5000 series switches.
Specify the IP address and the UDP port number used to identify FlowCollector as the receiver of exported NetFlow data. In a default FlowCollector installation, UDP ports 9995 and 9996 are automatically configured as the UDP ports FlowCollector uses to receive NetFlow exported data.
Enable NetFlow data export

For information on Cisco IOS software features related to NetFlow services on Cisco 7500, 7200, and 7000 series routers, refer to the Cisco IOS Release 11.1(2) or later configuration guides and command references. For information on specific configuration commands, refer to the "NetFlow Switching Enhancements" feature module in the Release Note for Cisco IOS Release 11.1 CA and Feature Modules.

For information on software features related to MLS on Catalyst 5000 series switches, refer to the Multilayer Switching User Guide.

Platforms Supported

FlowCollector is available for the following platforms:

HP-UX--Version 11.0. Recommended to run on a Class C workstation (or higher) with at least 128 MB RAM, 512 MB of swap space, and at least 4.0 gigabytes (GB) of disk space.
Solaris--Version 2.5.1 or 2.6. Recommended to run on a minimum of an ULTRA-1 workstation with at least 128 MB RAM, 512 MB of swap space, and at least 4.0 GB of disk space.

: Note that newer workstations from Sun Microsystems, such as the ULTRA-5, provide better performance for the price than earlier workstations such as the ULTRA-1.

Note To prevent NetFlow data export packet loss, the workstation should be on the same LAN as its NetFlow data export devices and should not be running other applications.

Installing FlowCollector

FlowCollector is distributed on CD-ROM for the Solaris and HP-UX platforms.

To install FlowCollector, perform the following steps:

Step 1 Verify that the target workstation for the installation meets the requirements described in the section "Platforms Supported," earlier in this chapter.

Step 2 Log in as the superuser (root).

Step 3 Identify a locally mounted partition, such as /tmp, that you can use to transfer the FlowCollector tar file from the distribution CD-ROM.

Note

Step 4 Copy the appropriate tar file from the NetFlow FlowCollector CD-ROM to a locally mounted directory such as /tmp.

For Solaris installations, use the NFC2_0.SOL.tar file.
For HP-UX installations, use the NFC2_0.HP_11.tar file.

Step 5 Extract the FlowCollector files from the tar file.

# tar -xvf NFC2_0.xxx.tar

Step 6 Start the installation script.

For Solaris installations, use ./NFC2_0.setup.sh NFC2_0.SOL.Z
For HP-UX installations, use ./NFC2_0.setup.sh NFC2_0.HP_11.Z
# ./NFC2_0.setup.sh NFC2_0.xxx.Z

********************************************************************
                     NetFlow FlowCollector 2.0
           Copyright (c) 1986-1998 by Cisco Systems, inc.
                        All rights reserved
********************************************************************

Hit Return to continue...

Note Accept the default installation actions in response to any prompts from the installation script.

When the installation script has successfully completed the installation, it displays the following message:

.

FlowCollector 2.0 installation completed successfully.

Step 7 Add the following environment variables to the startup files (.cshrc or .profile) of all users wanting to run FlowCollector:

Set NFC_DIR to /opt/CSCOnfc
Set NFC_RESOURCEFILE to $NFC_DIR/config/nf.resources

Step 8 Log out.

Starting FlowCollector

To run FlowCollector, you can be logged in as a user or as root.

To start FlowCollector, perform the following steps:

Step 1 Log in.

Step 2 Use the following command to start FlowCollector:

$ $NFC_DIR/bin/nfcollector start all

Verifying that FlowCollector Is Running

To verify that FlowCollector is running properly, perform the following steps:

Step 1 Use the following command to display a table of FlowCollector statistics:

$ $NFC_DIR/bin/NFUI -s

10. Retrieve application stats
FlowCollector has been up since Wed May 20 13:56:49 1998

Port    Packets rcvd(wrap)    Records(wrap)    Discarded  Missed Recs(wrap)
----    ------------------    -------------    ---------  -----------------
9995                  0(0)             0(0)            0               0(0)

9996              70748(0)       2122440(0)            0               0(0)

Note The statistics are listed according to the UDP port numbers on which FlowCollector is expecting NetFlow data. In a default FlowCollector installation, UDP ports 9995 and 9996 are automatically configured as the UDP ports. You can define other UDP port numbers (refer to the section "

Creating a Thread

Customizing FlowCollector

Step 2 Verify that the UDP ports that are expected to receive export data are receiving data.

In the example shown above, UDP port 9996 is collecting data, but UDP port 9995 is not.

Step 3 Check the $NFC_DIR/logs/nfc.log and $NFC_DIR/logs/nfcd.log files for error messages.

If you are receiving data on the FlowCollector UDP port and there are no error messages in the log files, FlowCollector is running properly. You should periodically monitor the $NFC_DIR/logs/nfc.log and $NFC_DIR/logs/nfcd.log files for error and warning messages.

Stopping FlowCollector

To stop FlowCollector, perform the following steps:

Step 1 Log in.

Step 2 Use the following command to stop FlowCollector:

# $NFC_DIR/bin/nfcollector stop all

Note To stop FlowCollector, you must be logged in as the user who started this FlowCollector session, or root.

Where to Go from Here

The remaining chapters and appendixes in this guide provide information on the following topics:

For more information on...	Refer to ...
NetFlow services and FlowCollector (for users who want more instruction and information about FlowCollector)	"FlowCollector Overview"
Installing, configuring, and validating FlowCollector (for users who want more instruction and information as they install and operate FlowCollector)	"Installing, Configuring, and Validating FlowCollector"
Using the NetFlow FlowCollector user interface (NFUI) to review application statistics and resource definitions--such as for threads, filters, and protocols, or to create and modify FlowCollector resource definitions	"Using the NetFlow FlowCollector User Interface"
Locating and understanding FlowCollector data files	"Understanding the FlowCollector Data File Format"
Customizing FlowCollector operation using thread, filter, and protocol definitions, lists of port and autonomous system numbers, and other FlowCollector configuration parameters	"Customizing FlowCollector"
Helpful information and procedures in case you encounter problems while using FlowCollector	"Troubleshooting"
NetFlow export datagram formats	"NetFlow Export Datagram Format"

Table of Contents

Quick Start: Installing and Using FlowCollector