Network Visibility Continued
NetFlow is one of those tools that’s been around forever, but until the last few years it hasn’t received a lot of attention outside of service provider and large enterprise networks. Recently, there have been a lot of NetFlow tools released by various vendors that are aimed at the mid-sized business market. What I’d like to do here is briefly introduce NetFlow for those who might not be familiar with it, then talk about how to use it from the IOS command line without needing to install any additional server-based tools.NetFlow Overviewexporter, and the external server is the collector. A great many network management vendors sell collector software. In this series of posts, we’re going to ignore the collector side and look only at the routers and switches that produce the statistics.NetFlow has evolved through a bunch of different versions over the years. I’m not going to go into the gory details of the differences between them. Suffice to say that the most commonly deployed version today is NetFlow version 5, with version 9 gaining ground. The main differences between them are that NetFlow v9 is “extensible”, meaning that it can support additional information types without a protocol rewrite, and that it can be configured to export different types of information to different collectors. Many vendors besides Cisco support flow-export protocols that are either very similar to, or compatible with Cisco Netflow. NetFlow version 9 is closely related to the IETF’s IPFIX protocol.In summary, NetFlow is often the first tool you should use when you need high-level information about traffic endpoints and traffic types, as opposed to link utilization or error counters. Other tools like NBAR and packet capture are great too, but I’ve found that I most often use them after checking NetFlow first.Common NetFlow Misunderstandings
Basically, NetFlow is a protocol for gathering statistics about traffic passing through a device and exporting that information to an external server for further processing and analysis. In NetFlow parlance, the router or switch is the
I’ve noticed over the years that there’s a fair amount of misunderstanding out there about what NetFlow can and can’t do. Here are some things to keep in mind:
- NetFlow doesn’t replace SNMP. Specifically, it doesn’t track information about link utilization, bandwidth configurations, error rates, queue drops, or any other interface-level characteristic. Rather, NetFlow collects statistical information about traffic that is passed across those interfaces. Most frequently, this information includes source and destination IP address, layer 4 protocol, source and destination port numbers, interface ID, and packet size. Depending on the version and configuration, however, it can include a wide variety of other packet attributes, including layer 2 information, TTL, BGP AS, TCP flags, VRF, multicast information, and more.
- NetFlow doesn’t track application layer information. While you can get a lot of information about what hosts are doing from stuff like port numbers, packet sizes, and IP addresses, you don’t have visibility into the actual application layer itself–so for example, you can’t use NetFlow to get a list of what websites people are visiting, because you can’t see the HTTP headers. You might be able to infer something about the websites based on reverse DNS resolution, but that’s not a very reliable tool in today’s world of virtual web hosts and content distribution networks. Now, I’m sure someone’s going to object that NetFlow v9 supports the export of raw packet data. This is true… but as far as I know this isn’t being used (yet) for application layer analysis, and exporting chunks of every packet is going to come with some possibly undesirable overhead.
- Not all Cisco products support NetFlow. Specifically, the widely-used Catalyst 3560/3750 switches and below don’t support it. This can be frustrating, since these switches are widely deployed in the SMB market as edge or even core devices. There are commercial and open-source tools that will take a raw packet flow from a tap or SPAN session and export NetFlow based on it, but these switches have no way to get the CLI interface to NetFlow that we’re going to discuss here.
In the next post, we’ll take a look at the NetFlow command line tools in IOS.
