monitoring, facilitates the investigation of dDoS attacks, and enables implementation of other security applications such as URL monitoring. Flexible NetFlow provides predefined types of packet sections of a user-configurable size. The following Flexible NetFlow commands (used in Flexible NetFlow flow record configuration mode) can be used to configure the predefined types of packet sections: collect ipv4 section header size bytes --Starts capturing the number of bytes specified by the bytes argument from the beginning of the IPv4 header of each packet. collect ipv4 section payload size bytes --Starts capturing bytes immediately after the IPv4 header from each packet.
The number of bytes captured is specified by the bytes argument. collect ipv6 section header size bytes --Starts capturing the number of bytes specified by the bytes argument from the beginning of the IPv6 header of each packet. The bytes values are the sizes in bytes of these fields in the flow record. If the corresponding fragment of the packet is smaller than the requested section size, Flexible NetFlow will fill the rest of the section field in the flow record with zeros. If the packet type does not match the requested section type, Flexible NetFlow will fill the entire section field in the flow record with zeros.
Flexible NetFlow adds a new Version 9 export format field type for the header and packet section types. Flexible NetFlow will communicate to the NetFlow collector the configured section sizes in the corresponding Version 9 export template fields. The payload sections will have a corresponding length field that can be used to collect the actual size of the collected section. Flexible NetFlow Match Parameters The following table describes Flexible NetFlow match parameters. You must configure at least one of the following match parameters for the flow records. Table 1:
Match Parameters Configuring Flexible NetFlow Flexible NetFlow Match Parameters Command Purpose match datalink {dot1q | ethertype | mac | vlan } Specifies a match to datalink or Layer 2 fields. The following command options are available: • dot1q—Matches to the dot1q field. • ethertype—Matches to the ethertype of the packet. • mac—Matches the source or destination MAC fields. • vlan—Matches to the VLAN that the packet is located on (input or output). match flow direction Specifies a match to the flow identifying fields. match interface {input | output} Specifies a match to the interface fields. The following command options are available: • input—Matches to the input interface.
• output—Matches to the output interface. Configuring Flexible NetFlow 7