- Another popular management protocol
that was created by Cisco is NetFlow.
NetFlow is used to collect IP network traffic
as it flows through an interface.
This type of visibility into the network
allows us to better understand how the traffic is behaving.
Some of the common network issues
that NetFlow helps to identify
are things like network bottlenecks,
we can use NetFlow's statistics
to find the top talkers in our network.
Or in other words,
those devices that may be using the most network resources.
Slow network performance can often
be traced back to these devices,
which are over utilizing bandwidth in an unnecessary manner
so we can free up those points.
Also, issues related to policy changes,
or new applications that have been introduced
into our network.
We can see what type of load adding services
such as Voice over IP traffic adds to the infrastructure
or measure how the network policies changes
affect our traffic flows,
we can detect unauthorized or problematic traffic as well.
This can include things such as end users unnecessarily
utilizing media streaming services
that may cause congestion,
and also devices that are using WAN traffic
which should not be doing so.
And we can also use NetFlow to identify security
vulnerabilities and anomalies on our network.
Things like worm detection is possible
when using NetFlow data.
It's important to understand how NetFlow
gives you network information in this manner.
So in order to do that,
we need to first understand what an IP flow is.
This is where the flow comes from in the net flow name.
And an IP flow is characterized as unidirectional traffic
or traffic going in a single direction.
So if we want to look at traffic crossing a router
in a single direction, if we have traffic,
let's say going out to a public web server
and that's coming into a single port,
NetFlow is going to examine each of those packets
for a specific set of attributes,
these attributes are often
referred to as the packets fingerprint
when we're talking about NetFlow.
Similar packets with the same fingerprints,
those are going to be grouped together into a flow record.
The attributes that NetFlow uses to group
these packets into a flow
are the IP source and destination address,
the source and destination port,
the layer three protocol type,
the router or switch interface,
and the type of service associated with the packet.
NetFlow can capture on ingress and egress,
that is traffic either coming into a port
or traffic exiting a port,
depending on how we configure that.
All of the packets that have these attributes in common
are going to be grouped together into a flow.
Those will be condensed and they'll be placed
into a database on the router called the NetFlow cache.
This will contain the flow information.
In other words, it would contain those attributes
that we've pointed out and that we see here.
And it would also contain things like
the total number of packets in the flow,
and the bytes per packet among other things.
Once this is in the NetFlow cache,
there are two primary ways to access this information.
First, is simply through the CLI using show commands.
This is useful if you're in need of some
immediate information while you're actively troubleshooting.
But obviously, this cache is going to be limited,
and it's not going to be very helpful in the long term
for an historical view of our network traffic,
it does have its place and it's great for troubleshooting.
But in order to truly leverage
all of the benefits of NetFlow,
you'd want to use a NetFlow collector,
which is the primary way to view this information.
A NetFlow collector is a device responsible for receiving,
interpreting and storing our flow records.
You could configure a router to export NetFlow records
from the cache out to a NetFlow collector.
And these collectors will have the ability
to really powerfully analyze and to correlate the data
into a very detailed and intuitive report,
you would see things such as graphs and charts
that are going to allow you to really easily see
network issues in a visual manner.
Tools like the Paessler's PRTG for example,
you can see an output from that here.
This tool allows you to monitor LAN, WAN, VPN
and individual application traffic
and it has some really detailed reporting
and alerting possible as well.
When using a NetFlow collector on average,
30 to 50 flows are bundled together
and transported over UDP to the NetFlow collector
where the collector can analyze in real time
and it can also keep that historical data
that we talked about.
Based on the NetFlow version,
the format of the exported data is going to vary slightly,
the two main versions that I'll mention here
are version five and version nine.
Version five is by far the most popular format used,
and the reason for this is that,
it has a fixed format that never changes,
so it's easier to read for most NetFlow collection
and reporting packages.
At the time of this recording,
version nine is the newest format.
This brings better security and analysis features,
and also the ability to accurately report
on multicast traffic.
The format for version nine is dynamic
and so that means that it changes
and that requires what are called
NetFlow version nine templates.
These templates are sent to the collector periodically
in order to inform the collector about which format
the data flow is being presented in,
so that correct interpretation can happen.
So that's an overview of NetFlow
and the advantages of using that on our network.
In our next video,
we'll take a look at how we can configure and verify
NetFlow configuration on a Cisco router.