Configuring NetFlow Switching

This chapter describes NetFlow switching. For a complete description of NetFlow commands used in this chapter, refer to the Cisco IOS Switching Services Command Reference. For documentation of other commands that appear in this chapter, you can use the command reference master index or search online. This chapter contains these sections:

• Understanding NetFlow Switching

• Configure NetFlow Switching

• NetFlow Switching Configuration Example

Understanding NetFlow Switching

NetFlow switching provides network administrators with access to "call detail recording" information from their data networks. Exported NetFlow data can be used for a variety of purposes, including network management and planning, enterprise accounting and departmental chargebacks, ISP billing, data warehousing and data mining for marketing purposes. NetFlow also provides a highly-efficient mechanism with which to process security access lists without paying as much of a performance penalty as is incurred with other available switching methods.

• NetFlow Switching Support

• Accounting Statistics

• NetFlow Data Format

• Configure NetFlow Switching

NetFlow Switching Support

NetFlow switching is supported on Cisco 7200 series routers Cisco 7500 series routers.

Accounting Statistics

NetFlow switching is a high-performance, network-layer switching path that captures as part of its switching function a rich set of traffic statistics. These traffic statistics include user, protocol, port, and type of service information that can be used for a wide variety of purposes such as network analysis and planning, accounting, and billing.

NetFlow switching is supported on IP and IP encapsulated traffic over all interface types and encapsulations except for ISL/VLAN, ATM, and Frame Relay interfaces when more than one input access control list is used on the interface, and ATM LANE.

Capturing Traffic Data

In conventional switching at the network layer, each incoming packet is handled on an individual basis with a series of functions to perform access list checks, capture accounting data, and switch the packet. With NetFlow switching, after a flow has been identified and access list processing of the first packet in the flow has been performed, all subsequent packets are handled on a "connection-oriented" basis as part of the flow, where access list checks are bypassed and packet switching and statistics capture are performed in tandem.

A network flow is identified as a unidirectional stream of packets between a give source and destination--both defined by a network-layer IP address and transport-layer port number. Specifically, a flow is identified as the combination of the following fields:

• Source IP address

• Destination IP address

• Source port number

• Destination port number

• Protocol type

• Type of service

• Input interface

NetFlow Cache

NetFlow switching operates by creating a flow cache that contains the information needed to switch and perform access list check for all active flows. The NetFlow cache is built by processing the first packet of a flow through the standard switching path (fast or optimum). As a result, each flow is associated with an incoming and outgoing interface port number and with a specific security access permission and encryption policy. The cache also includes entries for traffic statistics that are updated in tandem with the switching of subsequent packets. After the NetFlow cache is created, packets identified as belonging to an existing flow can be switched based on the cached information and security access list checks bypassed. Flow information is maintained within the NetFlow cache for all active flows.

NetFlow Data Format

NetFlow exports flow information in UDP datagrams in one of two formats. The version 1 format was the initial released version, and version 5 is a later enhancement to add Border Gateway Protocol (BGP) autonomous system (AS) information and flow sequence numbers. Versions 2 through 4 were not released.

In version 1 and version 5 format, the datagram consists of a header and one or more flow records. The first field of the header contain the version number of the export datagram. Typically a receiving application that accepts either format allocates a buffer big enough for the biggest possible datagram from either format and uses the version from the header to determine how to interpret the datagram. The second field in the header is the number of records in the datagram and should be used to index through the records.

All fields in either version 1 or version 5 formats are in network byte order. Table 2 and Table 3 describe the data format for version 1, and Table 4 and Table 5 describe the data format for version 5.

Cisco recommends that receiving applications sanity check datagrams to ensure that the datagrams are from a valid NetFlow source. We recommend you first check the size of the datagram to make sure it is at least long enough to contain the version and count fields. Next we recommend you verify that the version is valid (1 or 5) and that the number of received bytes is enough for the header and count flow records (using the appropriate version).

Because NetFlow export uses User Datagram Protocol (UDP) to send export datagrams, it is possible for datagrams to be lost. To determine whether or not flow export information is lost, the version 5 header format contains a flow sequence number. The sequence number is equal to the sequence number of the previous plus the number of flows in the previous datagram. After receiving a new datagram, the receiving application can subtract the expected sequence number from the sequence number in the header to get the number of missed flows. Table 2 lists the bytes for version 1 header format.

Table 3 lists the byte definitions for version 1 flow record format.

Table 4 lists the byte definitions for version 5 header format.

Table 5 lists the byte definitions for version 5 flow record format.

Configure NetFlow Switching

NetFlow switching is one of the four available switching modes. When you configure NetFlow on an interface, the other switching modes are not used on that interface. Optimum switching remains the most efficient switching mode and results in the highest throughput when extensive access list processing is not required. NetFlow comes in a close second (within 15 to 20 percent of optimum switching throughput, possibly higher when access lists are involved). Fast switching is third fastest, with process switching the slowest of all. Also, with NetFlow switching you can export data (traffic statistics) to a remote workstation for further processing.

NetFlow switching is based on identifying packet flows and performing switching and access list processing within a router. It does not involve any connection-setup protocol either between routers or to any other networking device or end station and does not require any change externally--either to the traffic or packets themselves or to any other networking device. Thus, NetFlow switching is completely transparent to the existing network, including end stations and application software and network devices like LAN switches. Also, because NetFlow switching is performed independently on each internetworking device, it does not need to be operational on each router in the network. Network planners can selectively invoke NetFlow switching (and NetFlow data export) on a router or interface basis to gain traffic performance, control, or accounting benefits in specific network locations.

To configure NetFlow switching, first configure the router for IP routing as described in the IP configuration chapters in the Network Protocols Configuration Guide, Part 1. After you configure IP routing, perform the following tasks beginning in global configuration mode:

NetFlow switching information can also be exported to network management applications. To configure the router to export NetFlow switching statistics maintained in the NetFlow cache to a workstation when a flow expires, perform one of the following tasks in global configuration mode:

Normally the size of the NetFlow cache will meet your needs. However, you can increase or decrease the number of entries maintained in the cache to meet the needs of your NetFlow traffic rates. The default is 64K flow cache entries. Each cache entry is approximately 64 bytes of storage. Assuming a cache with the default number of entries, approximately 4MB of DRAM would be required. Each time a new flow is taken from the free-flow queue, the number of free flows is checked. If there are only a few free flows remaining, NetFlow attempts to age 30 flows using an accelerated timeout. If there is only one free flow remaining, NetFlow automatically ages 30 flows regardless of their age. The intent is to ensure free flow entries are always available.

To customize the number of entries in the NetFlow cache, perform the following task in global configuration mode:

Task	Command
Change the number of entries maintained in the NetFlow cache. The number of entries can be 1024 to 524288. The default is 65536.	ip flow-cache entries number

Caution Cisco recommends that you not change the NetFlow cache entries. Improper use of this feature could cause network problems. To return to the default NetFlow cache entries, use the no ip flow-cache entries global configuration command.

Manage NetFlow Switching Statistics

You can display and clear NetFlow switching statistics. NetFlow statistics consist of IP packet size distribution, IP flow switching cache information, and flow information such as the protocol, total flow, flows per second, and so forth. The resulting information can be used to find out information about your router traffic. To manage NetFlow switching statistics, perform any of the following tasks in privileged EXEC mode:

Configure IP Distributed and NetFlow Switching on VIP Interfaces

On Cisco 7500 series routers with a Route Switch Processor (RSP) and with Versatile Interface Processor (VIP) controllers, the VIP hardware can be configured to switch packets received by the VIP with no per-packet intervention on the part of the RSP. This process is called distributed switching. Distributed switching decreases the demand on the RSP.

The VIP hardware can also be configured for NetFlow switching, a new high-performance feature that identifies initiation of traffic flow between internet endpoints, caches information about the flow, and uses this cache for high-speed switching of subsequent packets within the identified stream.

To export NetFlow switching cache entries to a workstation when a flow expires, perform the following task in global configuration mode:

To improve performance, fragmented IP packets are optimum or flow switched (depending which switching method is enabled) rather than being process switched by default on Cisco 7500 series routers.

NetFlow Switching Configuration Example

The following example shows how to modify the configuration of serial interface 3/0/0 to enable NetFlow switching and to export the flow statistics for further processing to UDP port 0 on a workstation with the IP address of 1.1.15.1. In this example, existing NetFlow statistics are cleared to ensure accurate information when the show ip cache flow command is executed to view a summary of the NetFlow switching statistics.

configure terminal
interface serial 3/0/0
 ip route-cache flow
 exit
 ip flow-export 1.1.15.1 0 version 5 peer-as
 exit
 clear ip flow stats