Cisco Catalyst 2960 Series, Configuration Manual

Page: 595 / 2288

NetFlow Predefined Records
Flexible NetFlow includes several predefined records that you can use to start monitoring traffic in your
network. The predefined records are available to help you quickly deploy Flexible NetFlow and are easier to
use than user-defined flow records. You can choose from a list of already defined records that may meet the
needs for network monitoring. As Flexible NetFlow evolves, popular user-defined flow records will be made
available as predefined records to make them easier to implement.
The predefined records ensure backward compatibility with your existing NetFlow collector configurations
for the data that is exported. Each of the predefined records has a unique combination of key and nonkey
fields that offer you the built-in ability to monitor various types of traffic in your network without customizing
Flexible NetFlow on your router.
Two of the predefined records (NetFlow original and NetFlow IPv4/IPv6 original output), which are functionally
equivalent, emulate original (ingress) NetFlow and the Egress NetFlow Accounting feature in original NetFlow,
respectively. Some of the other Flexible NetFlow predefined records are based on the aggregation cache
schemes available in original NetFlow. The Flexible NetFlow predefined records that are based on the
aggregation cache schemes available in original NetFlow do not perform aggregation. Instead each flow is
tracked separately by the predefined records.
User-Defined Records
Flexible NetFlow enables you to define your own records for a Flexible NetFlow flow monitor cache by
specifying the key and nonkey fields to customize the data collection to your specific requirements. When
you define your own records for a Flexible NetFlow flow monitor cache, they are referred to as
user-defined
records . The values in nonkey fields are added to flows to provide additional information about the traffic in
the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for
nonkey fields are taken from only the first packet in the flow. Flexible NetFlow enables you to capture counter
values such as the number of bytes and packets in a flow as nonkey fields.
Flexible NetFlow adds a new Version 9 export format field type for the header and packet section types.
Flexible NetFlow will communicate to the NetFlow collector the configured section sizes in the corresponding
Version 9 export template fields. The payload sections will have a corresponding length field that can be used
to collect the actual size of the collected section.
NetFlow Lite Match Parameters
You can match these key fields for the flow record:
• IPv4 or IPv6 destination address
• Datalink fields (source and destination MAC address, and MAC ethertype (type of networking protocol)).
• Transport field source and destination ports to identify the type of application: ICMP, IGMP, or TCP
traffic.
The following table describes NetFlow Lite match parameters. You must configure at least one of the following
match parameters for the flow records.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
513
Information About NetFlow Lite