Promcis netflow monitor

ContentsConfiguring SNMP and using the NetFlow MIB to Monitor NetFlow DataFinding Feature InformationPrerequisites for Configuring SNMP and the NetFlow MIB to Monitor NetFlow DataRestrictions for Configuring SNMP and the NetFlow MIB to Monitor NetFlow DataInformation About Configuring SNMP and the NetFlow MIB to Monitor NetFlow DataNetFlow MIB Feature BenefitsNetFlow MIB OverviewTerminology UsedUsing SNMP and MIBs to Extract NetFlow InformationObjects That are Used by the NetFlow MIBHow to Configure SNMP and use the NetFlow MIB to Monitor NetFlow DataConfiguring the Router to use SNMPConfiguring Options for the Main CacheConfiguring Options for the Main CacheIdentifying the Interface Number to use for Enabling NetFlow with SNMPConfiguring NetFlow on an InterfaceConfiguring NetFlow on an InterfaceConfiguring the Destination-Prefix Aggregation CacheConfiguring the Destination-Prefix Aggregation CacheConfiguring NetFlow Export from the Main NetFlow Cache using the Version 9 Export FormatConfiguring NetFlow Export from the Main NetFlow Cache using the Version 9 Export FormatConfiguration Examples using SNMP and the NetFlow MIB to Monitor NetFlow DataConfiguring the Minimum Mask for a Source Prefix Aggregation Scheme using SNMP ExampleConfiguring NetFlow Data Export for the Source Prefix Aggregation Scheme using SNMP ExampleConfiguring a NetFlow Minimum Mask for a Prefix Aggregation Cache using SNMP ExampleUsing SNMP to Gather Flow Information From the Router ExampleAdditional ReferencesFeature Information for Configuring SNMP and using the NetFlow MIB to Monitor NetFlow DataGlossaryConfiguring SNMP and using the NetFlow MIB to Monitor NetFlow Data NetFlow is a technology that provides highly granular per-flow statistics on traffic in a Cisco router. The NetFlow MIB feature provides MIB objects to allow users to configure NetFlow and to monitor flow cache information, the current NetFlow configuration, and statistics. Finding Feature InformationPrerequisites for Configuring SNMP and the NetFlow MIB to Monitor NetFlow DataRestrictions for Configuring SNMP and the NetFlow MIB to Monitor NetFlow DataInformation About Configuring SNMP and the NetFlow MIB to Monitor NetFlow DataHow to Configure SNMP and use the NetFlow MIB to Monitor NetFlow DataConfiguration Examples using SNMP and the NetFlow MIB to Monitor NetFlow DataAdditional ReferencesFeature Information for Configuring SNMP and using the NetFlow MIB to Monitor NetFlow DataGlossaryFinding Feature Information Your software release may not support all the features

A system responsible for managing at least part of a network. An NMS is generally a reasonably powerful and well-equipped computer, such as an engineering workstation. NMSs communicate with agents to help keep track of network statistics and resources. SNMP --Simple Network Management Protocol. A network management protocol used almost exclusively in TCP/IP networks. SNMP provides a means to monitor and control network devices, and to manage configurations, statistics collection, performance, and security. SNMP communities --An authentication scheme that enables an intelligent network device to validate SNMP requests. ToS byte --type of service byte. Second byte in the IP header that indicates the desired quality of service for a particular datagram.Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data ContentsConfiguring SNMP and using the NetFlow MIB to Monitor NetFlow DataFinding Feature InformationPrerequisites for Configuring SNMP and the NetFlow MIB to Monitor NetFlow DataRestrictions for Configuring SNMP and the NetFlow MIB to Monitor NetFlow DataInformation About Configuring SNMP and the NetFlow MIB to Monitor NetFlow DataNetFlow MIB Feature BenefitsNetFlow MIB OverviewTerminology UsedUsing SNMP and MIBs to Extract NetFlow InformationObjects That are Used by the NetFlow MIBHow to Configure SNMP and use the NetFlow MIB to Monitor NetFlow DataConfiguring the Router to use SNMPConfiguring Options for the Main CacheConfiguring Options for the Main CacheIdentifying the Interface Number to use for Enabling NetFlow with SNMPConfiguring NetFlow on an InterfaceConfiguring NetFlow on an InterfaceConfiguring the Destination-Prefix Aggregation CacheConfiguring the Destination-Prefix Aggregation CacheConfiguring NetFlow Export from the Main NetFlow Cache using the Version 9 Export FormatConfiguring NetFlow Export from the Main NetFlow Cache using the Version 9 Export FormatConfiguration Examples using SNMP and the NetFlow MIB to Monitor NetFlow DataConfiguring the Minimum Mask for a Source Prefix Aggregation Scheme using SNMP ExampleConfiguring NetFlow Data Export for the Source Prefix Aggregation Scheme using SNMP ExampleConfiguring a NetFlow Minimum Mask for a Prefix Aggregation Cache using SNMP ExampleUsing SNMP to Gather Flow Information From the Router ExampleAdditional ReferencesFeature Information for Configuring SNMP and using the NetFlow MIB to Monitor NetFlow DataGlossaryConfiguring SNMP and using the NetFlow MIB to Monitor NetFlow Data NetFlow is a technology

That provides highly granular per-flow statistics on traffic in a Cisco router. The NetFlow MIB feature provides MIB objects to allow users to configure NetFlow and to monitor flow cache information, the current NetFlow configuration, and statistics. Finding Feature InformationPrerequisites for Configuring SNMP and the NetFlow MIB to Monitor NetFlow DataRestrictions for Configuring SNMP and the NetFlow MIB to Monitor NetFlow DataInformation About Configuring SNMP and the NetFlow MIB to Monitor NetFlow DataHow to Configure SNMP and use the NetFlow MIB to Monitor NetFlow DataConfiguration Examples using SNMP and the NetFlow MIB to Monitor NetFlow DataAdditional ReferencesFeature Information for Configuring SNMP and using the NetFlow MIB to Monitor NetFlow DataGlossaryFinding Feature Information Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required. Prerequisites for Configuring SNMP and the NetFlow MIB to Monitor NetFlow Data Before you enable NetFlow you must: Configure the router for IP routing Ensure that one of the following is enabled on your router, and on the interfaces that you want to configure NetFlow on: Cisco Express Forwarding (CEF), distributed CEF, or fast switching Understand the resources required on your router because NetFlow consumes additional memory and CPU resources Configure SNMP on the router on which the NetFlow MIB feature is to be used. Refer to the Configuring the Router to use SNMP for more information. For more information on configuring an SNMP server, refer to the Configuring SNMP Support in the Cisco IOS Network Management Configuration Guide . Restrictions for Configuring SNMP and the NetFlow MIB to Monitor NetFlow DataCisco IOS Releases 12.2(14)S, 12.0(22)S, or 12.2(15)T If

Supports the Flexible NetFlow - Top N Talkers Support feature. No configuration tasks are associated with the Flexible NetFlow - Top N Talkers Support feature. Therefore, in order for you to use the Flexible NetFlow - Top N Talkers Support feature, traffic analysis with Flexible NetFlow must already be configured on the networking device. Information About Flexible NetFlow - Top N Talkers Support Flexible NetFlow Data Flow Filtering The flow filtering function of the Flexible NetFlow - Top N Talkers Support feature filters the flow data in a flow monitor cache based on the criteria that you specify, and displays the data. The flow filtering function of the Flexible NetFlow - Top N Talkers Support feature is provided by the show flow monitor cache filter command. For more information on the show flow monitor cache filter command, refer to the Cisco IOS Flexible NetFlow Command Reference. Flexible NetFlow Data Flow Aggregation Flow aggregation using the show flow monitor cache aggregate command allows you to dynamically view the flow information in a cache using a different flow record than the cache was originally created from. Only the fields in the cache will be available for the aggregated flows. The flow aggregation function of the Flexible NetFlow - Top N Talkers Support feature is provided by the show flow monitor cache aggregate command. For more information on the show flow monitor cache aggregate command, refer to the Cisco IOS Flexible NetFlow Command Reference. Flow Sorting and Top N Talkers The flow sorting function of the Flexible NetFlow - Top N Talkers Support feature sorts flow data from the Flexible NetFlow cache based on the criteria that you specify and displays the data. You can also use the flow sorting function of the Flexible NetFlow - Top N Talkers Support feature to limit the display output to a specific number of entries (top n talkers, where n is the number or talkers to display) by using the top keyword of the show flow monitor cache sort command. The flow sorting and Top N Talkers function of the Flexible NetFlow - Top N Talkers

Contents Overview of Netflow NetFlow Support on L2VPN and L3VPN Prerequisites for Netflow Monitoring Restrictions for Netflow Monitoring for ASR 920 Series Routers Information About Flexible Netflow Flexible NetFlow Overview NetFlow IPv4 Supported Fields NetFlow IPv6 Supported Fields How to Configure Flexible Netflow Workflow for Configuring Netflow Monitoring Displaying the Current Status of a Flow Record Verifying the Flow Record Configuration Displaying the Current Status of a Flow Monitor Configuration Examples for Flexible Netflow Verifying Netflow Monitoring on IPv4 Routed Interfaces Verifying Netflow Monitoring on IPv6 Routed Interfaces Verifying Netflow Monitoring for IPv4 traffic on EFP interfaces Verifying Netflow Monitoring for IPv6 traffic on EFP interfaces Additional References Overview of Netflow NetFlow is a Cisco IOS technology that provides statistics on packets flowing through the router. NetFlow is the standard for acquiring IP operational data from IP networks. NetFlow provides data to enable network and security monitoring, network planning, traffic analysis, and IP accounting. The following features are supported for Netflow: Netflow—IPv4 and IPv6 unicast flows Netflow Export over IPv4 and IPv6 addresses For information on understanding and configuring Netflow, see Flexible NetFlow Configuration Guide. NetFlow Support on L2VPN and L3VPN Table 1. Feature History Feature Name Release Information Feature Description Ingress and Egress Flexible NetFlow Cisco IOS XE Bengaluru 17.6.1 Flexible NetFlow allows you to monitor the traffic from access circuit on an L2VPN and L3VPN network. In addition to monitoring traffic in routed and ethernet service interfaces, you can now monitor traffic in VRF enabled L2 VFI (virtual forwarding interfaces) and cross-connect services. On an L2VPN network, the ingress and egress monitor are attached to L2 VFI enabled Ethernet Flow Point (EFP) in an access circuit. On an L3VPN network, the ingress and egress monitor are attached to VRF enabled interface in an access circuit. Note NetFlow is supported on both ingress and egress direction in an access circuit network. Prerequisites for Netflow Monitoring Netflow Version 9 is the only default export format supported on the router. Netflow support is made available through a separate FPGA Image. This is applicable for ASR-920-12CZ-A, ASR-920-12CZ-D, ASR-920-4SZ-A, ASR-920-4SZ-D, ASR-920-12SZ-IM, and ASR-920-24SZ-IM routers. To configure netflow and issue netflow commands, select the template For Cisco ASR-920-12SZ-A, Cisco ASR-920-12SZ-D, Cisco ASR-920-12CZ-A, ASR-920-12CZ-D, ASR-920-4SZ-A, ASR-920-4SZ-D, and ASR-920-12SZ-IM routers—sdm prefer netflow-video. Note Sets the template to video, and also allows configuration of netflow monitoring options by upgrading the router with the netflow supported FPGA. Cisco

Both netflow and PBR features use the same TCAM region for adding rules. The maximum size of the tunnel region is 2K. The scale of PBR feature may be reduced when netflow is enabled. SDM template must be set as video (similar to PBR) using the sdm prefer video command. This is applicable on the Cisco ASR-920-24SZ-IM, ASR-920-24SZ-M, ASR-920-24TZ-M, and ASR-920-20SZ-M routers. SDM template must be set as netflow-video using the sdm prefer netfow-video command for Cisco ASR-920-12CZ-A, ASR-920-12CZ-D, ASR-920-4SZ-A, ASR-920-4SZ-D, ASR-920-12SZ-IM, ASR-920-12SZ-A, ASR-920-12SZ-D, and ASR-920-24SZ-IM routers. When PBR and netflow is applied together on an interface, the order of operations is applicable. If PBR is applied first, netflow configuration will not work and vice-versa. We recommend to remove netflow related commands before reverting to non-netflow-supported sdm template or image. At the global level, SADT re-directs traffic towards FPGA. If SADT re-directs high volumes of traffic to FPGA, then netflow configuration may not work. If SADT and netflow is enabled on the same interface, only the SADT ingress packets are monitored. SADT egress packet monitoring is not monitored. This is applicable on the Cisco ASR-920-24SZ-IM, ASR-920-24SZ-M, ASR-920-24TZ-M, and ASR-920-20SZ-M routers. When netflow and Ethernet loopback (ELB) is enabled on same interface, the netflow monitoring behavior is inconsistent for the data packets. Data packets are not monitored intermittently, and netflow and OSPF flaps are observed when ELB is enabled. Note We recommend you avoid enabling ELB and netflow together, since the results are unexpected and inconsistent. Sampler is not supported due to FPGA limitations. IP flow monitor should not be applied before assigning IP address. When netflow and ACL configurations are applied together on routed interfaces in ingress direction, the denied packets are accounted in the netflow counters. When the same ACL and netflow combination configurations are applied on an EFP, the denied packets are not accounted in the netflow counters. For clearing the flow status and cache, use the clear flow monitor statistics command and clear flow exporter statistics commands. Other clear commands shall not reset the entries. Multiple flow monitors with the same traffic type and direction are not supported on an interface. Possible combinations supported on an interface at the same time are: ip flow monitor input ip flow monitor output ipv6 flow monitor input ipv6 flow monitor output Maximum number of interfaces that support netflow monitoring at chassis level is 64. Flow records are exported only when