Netflow

Version 5: limited to IPv4 flows

Version 9: template-based, IPv4, IPv6, MPLS, BGP.

Netflow 5 Configuration

ip flow-export version 5
ip flow-export destination 10.10.10.100 2055
ip flow-export source Loopback0
ip flow-cache timeout active 10
ip flow-cache timeout inactive 25
ip flow-top-talkers
	top 10
	
interface vlan 100
	ip flow ingress
	ip flow egress
	
show ip cache flow
show ip flow top-talkers
show ip flow export

Flexible Netflow Configuration

Flow Records - the definitions of what you want to capture

flow record MYRECORD
	match ipv4 destination address
	match ipv4 tos
	collect interface output
	collect counter bytes
	collect counter packets

Flow Exporter - used to send the traffic to a remote system

flow exporter MYEXPORTER
	destination 10.10.10.100
	source Loopback0
	transport udp 2055
	export-protocol netflow-v9

Flow Monitor - applied to the interface to actually monitor traffic

flow monitor MYMOITOR
	record MYRECORD
	exporter MYEXPORTER

interface vlan 100
	ip flow monitor MYMONITOR input
	
ip flow-export version 9

Flow Sampler - used to limit the load on the router gathering data