Cisco Catalyst 2960 Series, Руководство по настройке

Страница: 594 / 2288

A flow is a unidirectional stream of packets that arrives on a source interface and has the same values for the
keys. A key is an identified value for a field within the packet. You create a flow using a flow record to define
the unique keys for your flow.
The switch supports the NetFlow Lite feature that enables enhanced network anomalies and security detection.
NetFlow Lite allows you to define an optimal flow record for a particular application by selecting the keys
from a large collection of predefined fields.
All key values must match for the packet to count in a given flow. A flow might gather other fields of interest,
depending on the export record version that you configure. Flows are stored in the NetFlow Lite cache.
You can export the data that NetFlow Lite gathers for your flow by using an exporter and export this data to
a remote system such as a NetFlow Lite collector. The NetFlow Lite collector can use an IPv4 address.
You define the size of the data that you want to collect for a flow using a monitor. The monitor combines the
flow record and exporter with the NetFlow Lite cache information.
Flexible NetFlow Components
Flexible NetFlow consists of components that can be used together in several variations to perform traffic
analysis and data export. The user-defined flow records and the component structure of Flexible NetFlow
facilitates the creation of various configurations for traffic analysis and data export on a networking device
with a minimum number of configuration commands. Each flow monitor can have a unique combination of
flow record, flow exporter, and cache type. If you change a parameter such as the destination IP address for
a flow exporter, it is automatically changed for all the flow monitors that use the flow exporter. The same
flow monitor can be used in conjunction with different flow samplers to sample the same type of network
traffic at different rates on different interfaces. The following sections provide more information on Flexible
NetFlow components:
Flow Records
In Flexible NetFlow a combination of key and nonkey fields is called a record. Flexible NetFlow records are
assigned to Flexible NetFlow flow monitors to define the cache that is used for storing flow data.
A flow record defines the keys that Flexible NetFlow uses to identify packets in the flow, as well as other
fields of interest that Flexible NetFlow gathers for the flow. You can define a flow record with any combination
of keys and fields of interest. The switch supports a rich set of keys. A flow record also defines the types of
counters gathered per flow. You can configure 64-bit packet or byte counters. The switch enables the following
match fields as the defaults when you create a flow record:
• match datalink — Layer 2 attributes
•
match ipv4
—
IPv4 attributes
•
match ipv6
—
IPv6 attributes
• match transport — Transport layer fields
•
match wireless
—
Wireless fields
Related Topics
Creating a Flow Record, on page 520
Example: Configuring a Flow, on page 534
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
512
Information About NetFlow Lite