Flow Records In Flexible NetFlow a combination of key and nonkey fields is called a record. Flexible NetFlow records are assigned to Flexible NetFlow flow monitors to define the cache that is used for storing flow data. Flexible NetFlow includes several predefined records that can help you get started using Flexible NetFlow. A flow record defines the keys that Flexible NetFlow uses to identify packets in the flow, as well as other fields of interest that Flexible NetFlow gathers for the flow. You can define a flow record with any combination of keys and fields of interest. The device supports a rich set of keys. A flow record also defines the types of counters gathered per flow.
You can configure 64-bit packet or byte counters. The device enables the following match fields as the defaults when you create a flow record: match datalink —Layer 2 attributes match flow direction —Specifies a match to the fields identifying the direction of flow. match interface —Interface attributes match ipv4 —IPv4 attributes match ipv6 —IPv6 attributes match transport —Transport layer fields match flow cts —Cisco TrustSec fields NetFlow Predefined Records Flexible NetFlow includes several predefined records that you can use to start monitoring traffic in your network.
The predefined records are available to help you quickly deploy Flexible NetFlow and are easier to use than user-defined flow records. You can choose from a list of already defined records that may meet the needs for network monitoring. As Flexible NetFlow evolves, popular user-defined flow records will be made available as predefined records to make them easier to implement. Predefined records are not supported for regular Flexible NetFlow on Cisco Catalyst 9000 Series Switches.
Note User-Defined Records Flexible NetFlow enables you to define your own records for a Flexible NetFlow flow monitor cache by specifying the key and nonkey fields to customize the data collection to your specific requirements. When you define your own records for a Flexible NetFlow flow monitor cache, they are referred to as user-defined records . The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
Flexible NetFlow enables you to capture counter values such as the number of bytes and packets in a flow as nonkey fields. You can create user-defined records for applications such as QoS and bandwidth monitoring, application and end user traffic profiling, and security monitoring for dDoS attacks. Flexible NetFlow also includes several predefined records that emulate original NetFlow. Flexible NetFlow user-defined records provide the capability to monitor a contiguous section of a packet of a user-configurable size, and use it in a flow record as a key or a nonkey field along with other fields and attributes of the packet. The section may include any Layer 3 data from the packet.
The packet section fields allow the user to monitor any packet fields that are not covered by the Flexible NetFlow predefined keys. The ability to analyze packet fields, enables more detailed traffic Configuring Flexible NetFlow Flow Records Configuring Flexible NetFlow 6