• Extensive use of Cisco’s flexible and extensible NetFlow Version 9. • A comprehensive IP accounting feature that can be used to replace many accounting features, such as IP accounting, Border Gateway Protocol (BGP) Policy Accounting, and persistent caches. Flexible NetFlow allows you to understand network behavior with more efficiency, with specific flow information tailored for various services used in the network. The following are some example applications for a Flexible NetFlow feature: • Flexible NetFlow enhances Cisco NetFlow as a security monitoring tool.
For instance, new flow keys can be defined for packet length or MAC address, allowing users to search for a specific type of attack in the network. • Flexible NetFlow allows you to quickly identify how much application traffic is being sent between hosts by specifically tracking TCP or UDP applications by the class of service (CoS) in the packets. • The accounting of traffic entering a Multiprotocol Label Switching (MPLS) or IP core network and its destination for each next hop per class of service. This capability allows the building of an edge-to-edge traffic matrix. The figure below is an example of how Flexible NetFlow might be deployed in a network. Figure 1:
Typical Deployment for Flexible NetFlow Flexible NetFlow Components Flexible NetFlow consists of components that can be used together in several variations to perform traffic analysis and data export. The user-defined flow records and the component structure of Flexible NetFlow facilitates the creation of various configurations for traffic analysis and data export on a networking device with a minimum number of configuration commands. Each flow monitor can have a unique combination of flow record, flow exporter, and cache type. If you change a parameter such as the destination IP address for a flow exporter, it is automatically changed for all the flow monitors that use the flow exporter.
The same flow monitor can be used in conjunction with different flow samplers to sample the same type of network traffic at different rates on different interfaces. The following sections provide more information on Flexible NetFlow components: Configuring Flexible NetFlow Flexible NetFlow Components Configuring Flexible NetFlow 5