Enable Flow Technologies

Flow Source Flow Timeout Configuration

The typical manufacturer setting is for a router to send flow data every 30 minutes. Sometimes referred to as the flow cache timeout, this setting defines the frequency that a router sends the flow table to the collector (SevOne NMS). This implicitly is the limit to which the router allows a flow to grow before breaking the flow into a new flow.

SevOne recommends that you configure routers to send flow data every one minute in order to have the router report to SevOne NMS in a timely manner that enables the even distribution of information transfer. Should you choose to set the flow source flow timeout configuration to something other than one minutes, the router reports less frequently and sends SevOne NMS larger flow tables which results in less granular report data. To compensate for this, SevOne NMS FlowFalcon reports provide a Granularity setting that enables you to view the report at the granularity that matches your router flow timeout configuration. A flow cache timeout other than one minute is not recommended.

The SevOne NMS Cluster Manager Cluster Settings provide a Drop Long Flows option that enables you to define a time limit for what you consider to be a long flow. When you use the Drop Long Flow option, SevOne NMS hides the traffic from routers that send flows that exceed the Max Flow Duration you enter. When a router sends flows that exceed the Max Flow Duration, an administrative message appears upon log on to inform administrators that flows from a specific router have been dropped. The Drop Long Flows feature is useful when you set the router cache timeout to be shorter than the Max Flow Duration you set in SevOne NMS, because long flows would then indicate that a router is misconfigured.

The Cluster Manager Cluster Setting provides the ability to adjust the interval at which SevOne NMS writes flow data to the database. The write interval sets the time window for which raw data is to be aggregated into the minimal aggregation. The Write Interval should be set to one minute. In the rare situation where you decide to change this setting, you should consider that every hour SevOne NMS takes flow data and creates 15 minute aggregations for the top <n> flows for each interface and view. Your Write Interval setting should therefore be divisible by 15 when you intend to use aggregated flow data.

Cisco IOS Router

Enable Cisco Express Forwarding

Enter the following command to enable Cisco Express Forwarding which is required for flow in most recent IOS releases.

router(config)# ip cef

Start NetFlow Export

In the configuration terminal on the router, enter the following commands to start NetFlow Data Export (NDE).

The address of your SevOne NMS appliance.

router(config)# ip flow-export destination <SevOne-IP> 9996

The source interface is used to set the source IP address of the NetFlow exports sent by the router.

ip flow-export source loopback

Sets the export version number.

router(config)# ip flow-export version 5 and 9

Break Up Flows into Shorter Segments

Breaks up long-lived flows into one minute segments.

ip flow-cache timeout active 1

Ensures the flows that have finished are exported in a timely manner.

ip flow-cache timeout inactive 15

Enable NetFlow on Each Physical Interface

Enter the following commands to enable NetFlow on each physical interface from which to collect a flow (not VLANs and Tunnels because they are automatically included). This is normally an Ethernet or WAN interface. You may need to set the speed of the interface in kilobits per second especially for frame relay or ATM virtual circuits.

interface <interface>

ip route-cache flow or ip flow ingress or ip route-cache cef

Write your configuration with the write or copy run start command.

Verify

When in enabled mode, enter the following command to view current NetFlow configuration and state.

Shows the current setup

router# show ip flow export

Summarizes the active flows and displays how much NetFlow data the router exports.

router# show ip cache flow

router# show ip cache verbose flow

Cisco Switches Running CatOS (Hybrid Mode)

4000 Series Catalyst Running in Hybrid or Native Mode

This series requires a Supervisor Engine IV with a NetFlow Services daughter card to support NDE.

Start NetFlow Export

In the configuration terminal on the router, enter the following command to start NetFlow export.

#ip flow-export version 9

#ip flow-export destination <SevOne-IP> 9996

Enable NetFlow on Each Physical Interface

Enter the following command to enable NetFlow on each physical interface.

interface <interface>

ip route-cache flow infer-fields

Juniper Switch

The following configuration enables sFlow monitoring for all interfaces on a Juniper EX switch, sampling packets at 1-in-500, polling counters every 30 seconds and sending the sFlow to SevOne NMS <SevOne-IP> on UDP port 6343.

protocols {

sflow {

polling-interval 30;

sample-rate 500;

collector <SevOne-IP> {

udp-port 6343;

}

interfaces ge-0/0/0.0;

interfaces ge-0/0/1.0;

Specify cflowd Options on an IP Interface

Enter the following command.

Interface Configurations

CLI Syntax: config>router>if#

cflowd {acl|interface}

no cflowd

Depending on the option selected, either acl or interface, cflowd extracts traffic flow samples from an IP filter or an interface for analysis. All packets forwarded by the interface are analyzed according to the cflowd configuration.

Enable the acl option to enable traffic sampling on an IP filter. You must enable Cflowd (filter-sample) in at least one IP filter entry.
Select the interface option to enable traffic sampling on an interface. If cflowd is not enabled (no cflowd) then traffic sampling does not occur on the interface.

Service Interfaces

CLI Syntax: config>service>vpls service-id# interface ip-int-name

cflowd {acl|interface}

active-timeout 20

inactive-timeout 10

overflow 10

rate 100

collector <SevOne-IP>:9996 version 8

aggregation

as-matrix

raw

exit

description <SevOne NMS>

exit

collector <SevOne-IP>:9996 version 8

aggregation

protocol-port

source-destination-prefix

exit

autonomous-system-type peer

description "Neighbor collector"

exit

Check for Traffic

If flow data does not display for the device, confirm that SevOne NMS actually receives the data via tcpdump.

Log in to the box and run one of the following commands.

Enter the following command to show all incoming flow traffic to SevOne NMS.

tcpdump -i eth0 port 9996

Enter the following command to show only flow traffic from a specific IP address.

tcpdump -i eth0 port 9996 | grep '<ip address in question>'

If data comes into SevOne NMS, you should eventually see a message similar to the following:

If no data comes in from the IP address, there may be a routing issue.

Check the Version

If flow data comes in, but nothing displays, the version may be wrong.

Enter the following command to dump the first portions of the packets to the page.

tcpdump -XX -i eth0 port 9996

Something similar to the following should display.

Example:
19:55:26.326485 IP <source>.52292 > <destination>.9996: UDP, length 1416
0x0000: 0030 482d 9e1b 0011 5d24 aec0 0800 4500 .0H-....]$....E.
0x0010: 05a4 f187 0000 fb11 ce64 0aff ff0c cc1b .........d......
0x0020: 2435 cc44 270c 0590 2b9f 0005 001d cada $5.Dâ...+.......
0x0030: 5584 45a3 f32e 0cd7 dd44 8682 7d8d 0001 U.E......D..}...
0x0040: 0000 aa94 ....
19:55:26.326609 IP <source>.58101 > <destination>.9996: UDP, length 1428
0x0000: 0030 482d 9e1b 0011 5d24 aec0 0800 4500 .0H-....]$....E.
0x0010: 05b0 b449 0000 f611 810a 0a00 8f98 cc1b ...I............
0x0020: 2435 e2f5 270c 059c fa38 0007 001b cdb8 $5..â....8......
0x0030: 2bdc 45a3 f32e 11a3 844e 29a1 03b4 0000 +.E......N).....
0x0040: 0000 0a33

In the above example, the first traffic is v5 and the second is v7 as indicated in the third row's sixth column. The last two digits in the column are the version.

The following is a visual aid to help find the version as indicated by the XX.

Example:
-::.----- IP <source>.----- > <destination>.9996: UDP, length ----
0x0000: ---- ---- ---- ---- ---- ---- ---- ---- ----------------
0x0010: ---- ---- ---- ---- ---- ---- ---- ---- ----------------
0x0020: ---- ---- ---- ---- ---- --XX ---- ---- ----------------
0x0030: ---- ---- ---- ---- ---- ---- ---- ---- ----------------
0x0040: ---- ----