NetFlow: Difference between revisions

Revision as of 10:27, 21 November 2005

Revision as of 11:38, 24 November 2005

Line 1:

'''Netflow''' is a [[Cisco Systems|Cisco]] IOS [[computer software|software]] feature and also the name of an open (but proprietary) Cisco protocol for collecting [[Internet Protocol|IP]] traffic information. Cisco [[router]]s with netflow enabled generate netflow records, which are exported from the router in [[User Datagram Protocol|UDP]] packets and collected using a netflow collector. [[Juniper Networks]] provides a similar feature for its routers called cflow.

A network flow is defined as IPa trafficunidirectional withsequence theof samepackets sourcebetween IP, destination IP,given source port and destination portendpoints. The router will only output a flow record when it determines that the flow is finished - it does this by flow aging; when the router sees new traffic for an existing flow it resets the aging counter. The flow record contains a version number, a sequence number, the IP address of the interface upon which the flow was observed, timestamps for the flow start and finish time, the volume of traffic in the flow, and its source & destination IP addresses and source and destination port numbers. By analyzing flow data, one can build a picture of traffic flow and traffic volume in a network. The netflow record format has evolved over time, hence the inclusion of version numbers. Cisco maintains details of the different version numbers and the layout of the packets for each version.

Netflow records are sent via UDP, and for efficiency reasons, the router does not store flow records once they are exported. Therefore, if the netflow record is dropped due to network congestion, it is lost forever -- there's no way for the router to resend it. The IP address of the netflow collector and the port upon which it is listening must be configured on the sending router. Netflow is also enabled on a per-interface basis to avoid unnecessarily burdening of the router's processor.