1-3
Cisco CNS NetFlow Collection Engine User Guide, Release 5.0.2
OL-6899-01
Chapter 1 Overview
What Are NetFlow Services?
•
Version 5 datagrams, up to 30 flows can be sent in a single UDP datagram of approximately 1500
bytes.
•
Version 7 datagrams, up to 27 flows can be sent in a single UDP datagram of approximately 1500
bytes.
•
Version 8 datagrams, the number of flows sent in a single UDP datagram varies by aggregation
scheme.
•
Version 9 datagrams, the number of flows is variable, and depends on the number and size of fields
defined in one or more templates.
See
Appendix B, “NetFlow Export Datagram Formats,”
in the
CNS NetFlow Collection Engine User
Guide
for details on all versions of the NetFlow data export format.
NetFlow Data Export Formats
NetFlow exports flow information in UDP datagrams in one of five formats: Version 1 (V1), Version 5
(V5), Version 7 (V7), Version 8 (V8), or Version 9 (V9).
Version 1 is the original format supported in the initial NetFlow releases. Version 5 is an enhancement
that adds Border Gateway Protocol (BGP) autonomous system information and flow sequence numbers.
Version 7 is an enhancement that exclusively supports Cisco Catalyst 5000 series switches equipped with
a NetFlow feature card (NFFC). V7 is not compatible with Cisco routers. Version 8 is an enhancement
that adds router-based aggregation schemes. Version 9 is an enhancement to support different
technologies such as Multicast, Internet Protocol Security (IPSec), and Multi Protocol Label Switching
(MPLS). CNS NetFlow Collection Engine Release 5.0 can collect, filter, and aggregate Version 9 data
in the same way it does for NetFlow Data Export Versions 1 through 8.
Versions 2, 3, 4, and 6 are not supported by CNS NetFlow Collection Engine. For more information on
the distinctions among the NetFlow data export formats, see
Appendix B, “NetFlow Export Datagram
Formats,”
in the
CNS NetFlow Collection Engine User Guide.
The following types of information are part of the detailed traffic statistics:
•
Source and destination IP addresses
•
Next hop address
•
Input and output interface numbers
•
Number of packets in the flow
•
Total bytes (octets) in the flow
•
First and last time stamps of packets that were switched as part of this flow
•
Source and destination port numbers
•
Protocol
•
Type of service (ToS)
•
Source and destination autonomous system (AS) numbers, either origin or peer (present in V5 and
select V8 datagrams)
•
Source and destination prefix mask bits (present in V5, V7, and V8 datagrams)
•
Shortcut router IP address (present in V7 on Cisco Catalyst 5000 series switches only).
