Flow Exporters Flow exporters export the data in the flow monitor cache to a remote system, such as a server running NetFlow collector, for analysis and storage. Flow exporters are created as separate entities in the configuration. Flow exporters are assigned to flow monitors to provide data export capability for the flow monitors. You can create several flow exporters and assign them to one or more flow monitors to provide several export destinations. You can create one flow exporter and apply it to several flow monitors. NetFlow Data Export Format Version 9 The basic output of NetFlow is a flow record. Several different formats for flow records have evolved as NetFlow has matured.
The most recent evolution of the NetFlow export format is known as Version 9. The distinguishing feature of the NetFlow Version 9 export format is that it is template-based. Templates provide an extensible design to the record format, a feature that should allow future enhancements to NetFlow services without requiring concurrent changes to the basic flow-record format. Using templates provides several key benefits: • Third-party business partners who produce applications that provide collector or display services for NetFlow do not have to recompile their applications each time a new NetFlow feature is added.
Instead, they should be able to use an external data file that documents the known template formats. • New features can be added to NetFlow quickly without breaking current implementations. • NetFlow is “future-proofed” against new or developing protocols because the Version 9 format can be adapted to provide support for them. The Version 9 export format consists of a packet header followed by one or more template flow or data flow sets. A template flow set provides a description of the fields that will be present in future data flow sets. These data flow sets may occur later within the same export packet or in subsequent export packets.
Template flow and data flow sets can be intermingled within a single export packet, as illustrated in the figure below. Configuring Flexible NetFlow Flow Exporters Command Purpose collect routing{ next-hop address |destination|source|forwarding-status|multicast Collects the following routing values: • next-hop address— Information regarding the next hop from the flows. • destination— Destination routing attributes. • source— Source routing attributes. • forwarding status— Forwarding status of the packet. • multicast— Multicast routing attributes.
collect policy firewall event Configures the collect policy firewall event as a non-key field and enables collecting information on SGACL denied or permitted traffic based on the traffic pattern. Configuring Flexible NetFlow 11