Cisco OL-6900-01 Operator's manual

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco CNS NetFlow Collection Engine
Installation and Configuration Guide, 5.0.2
February, 2005
Customer Order Number: N/A
Text Part Number: OL-6900-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco CNS NetFlow Collection Engine Installation and Configuration Guide, 5.0.2
Copyright © 2005, Cisco Systems, Inc.
All rights reserved.
CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and
iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco
Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Empowering the Internet Generation,
Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ
Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Pack et, PIX, Post-Routing, Pre-Routing,
ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StrataView Plus, TeleRouter, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered
trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0502R)

iii
Cisco CNS NetFlow Collection Engine Installation and Configuration Guide, 5.0.2
OL-6900-01
CONTENTS
Supplemental License Agreement v
Supplemental License Agreement For Cisco Systems Network Management Software: Cisco NetFlow
Collection Engine v
Additional License Restrictions v
Installation and Use v
Reproduction and Distribution v
Description Of Other Rights and Limitations vi
About This Guide vii
Objective vii
Audience vii
How This Guide Is Organized viii
Command Syntax Conventions viii
Obtaining Documentation viii
World Wide Web viii
Ordering Documentation ix
Documentation Feedback ix
Obtaining Technical Assistance ix
Cisco.com ix
Technical Assistance Center x
Cisco Technical Support Web Site x
Cisco TAC Escalation Center xi
CHAPTER 1Overview 1-1
What Are NetFlow Services? 1-1
NetFlow Services Device and IOS Release Support 1-2
NetFlow Data Export 1-2
How and When Flow Statistics Are Exported 1-2
NetFlow Data Export Formats 1-3
What Is CNS NetFlow Collection Engine? 1-4
CNS NetFlow Collection Engine Architectural Overview 1-5
Collector 1-6
Web-Based User Interface 1-6
CNS/XML Interface 1-7

Contents
iv
Cisco CNS NetFlow Collection Engine Installation and Configuration Guide, 5.0.2
OL-6900-01
Report Generator 1-7
BGP Peer 1-7
CHAPTER 2Installing CNS NetFlow Collection Engine 2-1
Verifying System Requirements 2-1
Using the CNS NetFlow Collection Engine Installation Script 2-2
Installing on a Solaris or HP-UX Platform 2-3
Installing on a Red Hat Enterprise Linux Platform 2-7
Uninstalling CNS NetFlow Collection Engine 5.0 2-10
CHAPTER 3Configuring CNS NetFlow Collection Engine 3-1
Required Patches and Software Packages 3-1
UNIX Environment Variables 3-2
Enabling NetFlow Data Export 3-2
Starting CNS NetFlow Collection Engine 3-2
Verifying That CNS NetFlow Collection Engine Is Running 3-3
NetFlow Collection Engine Configuration Files 3-3
Browser Requirements 3-4
Stopping CNS NetFlow Collection Engine 3-4
I NDEX

v
Cisco CNS NetFlow Collection Engine Installation and Configuration Guide, Release 5.0.2
OL-6900-01
Supplemental License Agreement
Supplemental License Agreement For Cisco Systems Network
Management Software: Cisco NetFlow Collection Engine
IMPORTANT–READ CAREFULLY: This Supplemental License Agreement (“SLA”) contains
additional limitations on the license to the Software provided to Customer under the Software License
Agreement between Customer and Cisco. Capitalized terms used in this SLA and not otherwise defined
herein shall have the meanings assigned to them in the Software License Agreement. To the extent that
there is a conflict among any of these terms and conditions applicable to the Software, the terms and
conditions in this SLA shall take precedence.
By installing, downloading, accessing or otherwise using the Software, Customer agrees to be bound by
the terms of this SLA. If Customer does not agree to the terms of this SLA, Customer may not install,
download, or otherwise use the Software. When used below, the term “server” refers to central processor
unit.
Additional License Restrictions
Installation and Use
The Software components are provided to Customer solely to install, update, supplement, or replace
existing functionality of the applicable Network Management Software product. Some license terms
such as device count and proof of preexisting licenses may be electronically enforced. Customer may
install and use following Software components:
Cisco NetFlow Collection Engine Software: May be installed on one (1) server in Customer's network
management environment.
Reproduction and Distribution
Customer may not reproduce nor distribute software.

vi
Cisco CNS NetFlow Collection Engine Installation and Configuration Guide, Release 5.0.2
OL-6900-01
Supplemental License Agreement
Additional License Restrictions
Description Of Other Rights and Limitations
Please refer to the Cisco Systems, Inc. Software License Agreement.

vii
Cisco CNS NetFlow Collection Engine Installation and Configuration Guide, Release 5.0.2
OL-6900-01
About This Guide
Objective
The Cisco CNS NetFlow Collection Engine Installation and Configuration Guide, Release 5.0.2
describes the CNS NetFlow Collection Engine application, which is used with the NetFlow services data
export feature on Cisco routers and Catalyst 5000 and 6000 series switches. This document also
describes the system requirements that must be met to install the CNS NetFlow Collection Engine
product, as well as, how to install, start, and configure CNS NetFlow Collection Engine.
NetFlow services consist of high-performance IP switching features that capture a rich set of traffic
statistics exported from routers and switches while they perform their switching function. CNS NetFlow
Collection Engine provides fast, scalable, and economical data collection from multiple export devices
exporting NetFlow data records.
Prior to reading this manual, you should read the Release Notes for Cisco CNS NetFlow Collection
Engine Release 5.0.2 document. These release notes provide information about known software and
documentation problems and any last minute information about the CNS NetFlow Collection Engine
software not available when this guide was produced.
In previous releases, this product was referred to as Cisco NetFlow FlowCollector (NFC).
Audience
This guide is intended primarily for individuals with network and system administration skills. You
should have a basic understanding of network design, operation, and terminology, as well as familiarity
with your own network configurations. You also must have a basic familiarity with Web browsers,
Hewlett Packard’s HP-UX, or Sun Microsystem’s Solaris Operating System.

viii
Cisco CNS NetFlow Collection Engine Installation and Configuration Guide, Release 5.0.2
OL-6900-01
About This Guide
How This Guide Is Organized
How This Guide Is Organized
This guide is organized as follows:
Chapter 1, “Overview,” describes the CNS NetFlow Collection Engine application.
Chapter 2, “Installing CNS NetFlow Collection Engine,” describes how to install the CNS NetFlow
Collection Engine.
Chapter 3, “Configuring CNS NetFlow Collection Engine,” describes how to configure CNS NetFlow
Collection Engine and then validate that it s operating properly.
An Index is also provided.
Command Syntax Conventions
Table 1 describes the syntax used with the commands in this document.
Obtaining Documentation
The following sections explain how to obtain documentation from Cisco Systems.
World Wide Web
You can access the most current Cisco documentation on the World Wide Web at the following URL:
http://www.cisco.com
Translated documentation is available at the following URL:
http://www.cisco.com/public/countries_languages.shtml
Table 1 Command Syntax Guide
Convention Description
boldface Commands and keywords.
italic Command input that is supplied by you.
[ ] Keywords or arguments that appear within square brackets are optional.
{ x | x | x } A choice of keywords (represented by x) appears in braces separated by
vertical bars. You must select one.
^ or Ctrl Represent the key labeled Control. For example, when you read ^D or
Ctrl-D, you should hold down the Control key while you press the D key.
screen font Examples of information displayed on the screen.
boldface screen font Examples of information that you must enter.
< > Nonprinting characters, such as passwords, appear in angled brackets.
[ ] Default responses to system prompts appear in square brackets.

ix
Cisco CNS NetFlow Collection Engine Installation and Configuration Guide, Release 5.0.2
OL-6900-01
About This Guide
Obtaining Technical Assistance
Ordering Documentation
Cisco documentation is available in the following ways:
•Registered Cisco Direct Customers can order Cisco product documentation from the Networking
Products MarketPlace:
http://www.cisco.com/cgi-bin/order/order_root.pl
•Registered Cisco.com users can order the Documentation CD-ROM through the online Subscription
Store:
http://www.cisco.com/go/subscription
•Nonregistered Cisco.com users can order documentation through a local account representative by
calling Cisco corporate headquarters (California, USA) at 408 526-7208 or, elsewhere in North
America, by calling 800 553-NETS (6387).
Documentation Feedback
If you are reading Cisco product documentation on Cisco.com, you can submit technical comments
electronically. Click Leave Feedback at the bottom of the Cisco Documentation home page. After you
complete the form, print it out and fax it to Cisco at 408 527-0730.
You can e-mail your comments to [e-mail].
To submit your comments by mail, use the response card behind the front cover of your document, or
write to the following address:
Cisco Systems
Attn: Document Resource Connection
170 West Tasman Drive
San Jose, CA 95134-9883
We appreciate your comments.
Obtaining Technical Assistance
Cisco provides Cisco.com as a starting point for all technical assistance. Customers and partners can
obtain documentation, troubleshooting tips, and sample configurations from online tools by using the
Cisco Technical Assistance Center (TAC) Web Site. Cisco.com registered users have complete access to
the technical support resources on the Cisco Technical Support Web Site.
Cisco.com
Cisco.com is the foundation of a suite of interactive, networked services that provides immediate, open
access to Cisco information, networking solutions, services, programs, and resources at any time, from
anywhere in the world.
Cisco.com is a highly integrated Internet application and a powerful, easy-to-use tool that provides a
broad range of features and services to help you to
•Streamline business processes and improve productivity
•Resolve technical issues with online support

x
Cisco CNS NetFlow Collection Engine Installation and Configuration Guide, Release 5.0.2
OL-6900-01
About This Guide
Obtaining Technical Assistance
•Download and test software packages
•Order Cisco learning materials and merchandise
•Register for online skill assessment, training, and certification programs
You can self-register on Cisco.com to obtain customized information and service. To access Cisco.com,
go to the following URL:
http://www.cisco.com
Technical Assistance Center
The Cisco TAC is available to all customers who need technical assistance with a Cisco product,
technology, or solution. Two types of support are available through the Cisco TAC: the Cisco Technical
Support Web Site and the Cisco TAC Escalation Center.
Inquiries to Cisco TAC are categorized according to the urgency of the issue:
•Priority level 4 (P4)—You need information or assistance concerning Cisco product capabilities,
product installation, or basic product configuration.
•Priority level 3 (P3)—Your network performance is degraded. Network functionality is noticeably
impaired, but most business operations continue.
•Priority level 2 (P2)—Your production network is severely degraded, affecting significant aspects
of business operations. No workaround is available.
•Priority level 1 (P1)—Your production network is down, and a critical impact to business operations
will occur if service is not restored quickly. No workaround is available.
Which Cisco TAC resource you choose is based on the priority of the problem and the conditions of
service contracts, when applicable.
Cisco Technical Support Web Site
The Cisco Technical Support Web Site allows you to resolve P3 and P4 issues yourself, saving both cost
and time. The site provides around-the-clock access to online tools, knowledge bases, and software. To
access the Cisco Technical Support Web Site, go to the following URL:
http://www.cisco.com/tac
All customers, partners, and resellers who have a valid Cisco services contract have complete access to
the technical support resources on the Cisco Technical Support Web Site. The Cisco Technical Support
Web Site requires a Cisco.com login ID and password. If you have a valid service contract but do not
have a login ID or password, go to the following URL to register:
http://www.cisco.com/register/
If you cannot resolve your technical issues by using the Cisco Technical Support Web Site, and you are
a Cisco.com registered user, you can open a case online by using the TAC Case Open tool at the
following URL:
http://www.cisco.com/tac/caseopen
If you have Internet access, it is recommended that you open P3 and P4 cases through the Cisco
Technical Support Web Site.

xi
Cisco CNS NetFlow Collection Engine Installation and Configuration Guide, Release 5.0.2
OL-6900-01
About This Guide
Obtaining Technical Assistance
Cisco TAC Escalation Center
The Cisco TAC Escalation Center addresses issues that are classified as priority level 1 or priority
level 2; these classifications are assigned when severe network degradation significantly impacts
business operations. When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC
engineer will automatically open a case.
To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to the following
URL:
http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml
Before calling, please check with your network operations center to determine the level of Cisco support
services to which your company is entitled; for example, SMARTnet, SMARTnet Onsite, or Network
Supported Accounts (NSA). In addition, please have available your service agreement number and your
product serial number.

xii
Cisco CNS NetFlow Collection Engine Installation and Configuration Guide, Release 5.0.2
OL-6900-01
About This Guide
Obtaining Technical Assistance

CHAPTER
1-1
Cisco CNS NetFlow Collection Engine User Guide, Release 5.0.2
OL-6899-01
1
Overview
This chapter describes the CNS NetFlow Collection Engine application, which is used with the NetFlow
services data export feature on Cisco routers and Catalyst 5000 and 6000 series switches.
This chapter includes the following sections:
•What Are NetFlow Services?
•What Is CNS NetFlow Collection Engine?
•CNS NetFlow Collection Engine Architectural Overview
What Are NetFlow Services?
NetFlow services consist of high-performance IP switching features that capture a rich set of traffic
statistics exported from routers and switches while they perform their switching functions. The exported
NetFlow data consists of traffic flows, which are unidirectional sequences of packets between a
particular source device and destination device that share the same protocol and transport-layer
information. The captured traffic statistics can be used for a wide variety of purposes, such as network
analysis and planning, network management, accounting, billing, and data mining.
Because of their unidirectional nature, flows from a client to a server are differentiated from flows from
the server to the client. Flows are also differentiated on the basis of protocol. For example, Hypertext
Transfer Protocol (HTTP) Web packets from a particular source host to a particular destination host
constitute a separate flow from File Transfer Protocol (FTP) file transfer packets between the same pair
of hosts.
Routers and switches identify flows by looking for the following fields within IP packets:
•Source IP address
•Destination IP address
•Source port number
•Destination port number
•Protocol type
•Type of service (ToS)
•Input interface

1-2
Cisco CNS NetFlow Collection Engine User Guide, Release 5.0.2
OL-6899-01
Chapter 1 Overview
What Are NetFlow Services?
Catalyst 5000 series switches can identify flows by looking at a subset of these fields. For example, they
can identify flows by source and destination address only.
Note For Catalyst 5000 series switches, the analog to NetFlow services is integrated Multilayer Switching
(MLS) management. Included are products, utilities, and partner applications designed to gather flow
statistics, export the statistics, and collect and perform data reduction on the exported statistics. MLS
management then forwards them to consumer applications for traffic monitoring, planning, and
accounting.
NetFlow Services Device and IOS Release Support
You can find the most up-to-date information available to help you determine the compatibility among
different Cisco hardware platforms, Cisco IOS software releases, and supported NetFlow data export
versions at the following URL:
http://tools.cisco.com/ITDIT/CFN/Dispatch?SearchText=Netflow&act=featSelect&rnFeatId=null
&featStartsWith=&task=TextSearch&altrole=
Note Except for descriptions requiring references to specific router or switch platforms, the remainder of this
chapter and the remaining chapters of this guide use the term export device instead of the terms router
and switch.
NetFlow Data Export
NetFlow data export makes NetFlow traffic statistics available for purposes of network planning, billing,
and so on. An export device configured for NetFlow data export maintains a flow cache used to capture
flow-based traffic statistics. Traffic statistics for each active flow are maintained in the cache and are
updated when packets within each flow are switched. Periodically, summary traffic statistics for all
expired flows are exported from the export device by means of User Datagram Protocol (UDP)
datagrams, which CNS NetFlow Collection Engine receives and processes.
How and When Flow Statistics Are Exported
NetFlow data exported from the export device contains NetFlow statistics for the flow cache entries that
have expired since the last export. Flow cache entries expire and are flushed from the cache when one
of the following conditions occurs:
•The transport protocol indicates that the connection is completed (TCP FIN) plus a small delay to
allow for the completion of the FIN acknowledgment handshaking.
•Traffic inactivity exceeds 15 seconds.
For flows that remain continuously active, flow cache entries currently expire every 30 minutes to ensure
periodic reporting of active flows.
NetFlow data export packets are sent to a user-specified destination, such as the workstation running
CNS NetFlow Collection Engine, either when the number of recently expired flows reaches a
predetermined maximum, or every second-whichever occurs first. For:
•Version 1 datagrams, up to 24 flows can be sent in a single UDP datagram of approximately 1200
bytes.

1-3
Cisco CNS NetFlow Collection Engine User Guide, Release 5.0.2
OL-6899-01
Chapter 1 Overview
What Are NetFlow Services?
•Version 5 datagrams, up to 30 flows can be sent in a single UDP datagram of approximately 1500
bytes.
•Version 7 datagrams, up to 27 flows can be sent in a single UDP datagram of approximately 1500
bytes.
•Version 8 datagrams, the number of flows sent in a single UDP datagram varies by aggregation
scheme.
•Version 9 datagrams, the number of flows is variable, and depends on the number and size of fields
defined in one or more templates.
See Appendix B, “NetFlow Export Datagram Formats,” in the CNS NetFlow Collection Engine User
Guide for details on all versions of the NetFlow data export format.
NetFlow Data Export Formats
NetFlow exports flow information in UDP datagrams in one of five formats: Version 1 (V1), Version 5
(V5), Version 7 (V7), Version 8 (V8), or Version 9 (V9).
Version 1 is the original format supported in the initial NetFlow releases. Version 5 is an enhancement
that adds Border Gateway Protocol (BGP) autonomous system information and flow sequence numbers.
Version 7 is an enhancement that exclusively supports Cisco Catalyst 5000 series switches equipped with
a NetFlow feature card (NFFC). V7 is not compatible with Cisco routers. Version 8 is an enhancement
that adds router-based aggregation schemes. Version 9 is an enhancement to support different
technologies such as Multicast, Internet Protocol Security (IPSec), and Multi Protocol Label Switching
(MPLS). CNS NetFlow Collection Engine Release 5.0 can collect, filter, and aggregate Version 9 data
in the same way it does for NetFlow Data Export Versions 1 through 8.
Versions 2, 3, 4, and 6 are not supported by CNS NetFlow Collection Engine. For more information on
the distinctions among the NetFlow data export formats, see Appendix B, “NetFlow Export Datagram
Formats,” in the CNS NetFlow Collection Engine User Guide.
The following types of information are part of the detailed traffic statistics:
•Source and destination IP addresses
•Next hop address
•Input and output interface numbers
•Number of packets in the flow
•Total bytes (octets) in the flow
•First and last time stamps of packets that were switched as part of this flow
•Source and destination port numbers
•Protocol
•Type of service (ToS)
•Source and destination autonomous system (AS) numbers, either origin or peer (present in V5 and
select V8 datagrams)
•Source and destination prefix mask bits (present in V5, V7, and V8 datagrams)
•Shortcut router IP address (present in V7 on Cisco Catalyst 5000 series switches only).

1-4
Cisco CNS NetFlow Collection Engine User Guide, Release 5.0.2
OL-6899-01
Chapter 1 Overview
What Is CNS NetFlow Collection Engine?
Caution Throughout this publication there are numerous examples of CNS NetFlow Collection Engine input
commands and output results. Included are examples of IP addresses. Be aware that IP address examples
are not usable IP addresses. The examples do not represent real-life configurations.
What Is CNS NetFlow Collection Engine?
CNS NetFlow Collection Engine provides fast, scalable, and economical data collection from multiple
export devices exporting NetFlow data records. Figure 1-1 shows an example of a typical NetFlow data
export scheme. In it, various export devices send export data to user-specified CNS NetFlow Collection
Engine UDP ports.
Figure 1-1 CNS NetFlow Collection Engine Overview
Each of the export devices in this example is configured for NetFlow data export. Part of the
configuration information for each export device includes the IP address and the UDP port number (a
logical port designator) that identify CNS NetFlow Collection Engine as the receiver of flows from this
export device. The UDP port number is a user-configurable designator: you can configure CNS NetFlow
Collection Engine to listen for flows on a number of different UDP ports, and then configure your export
devices so that each device exports flows to a dedicated UDP port, or have a number of devices export
flows to the same, shared UDP port.
After you configure and start CNS NetFlow Collection Engine, it listens to the user-specified UDP ports
for exported flows from the export devices you have configured for NetFlow data export.
CNS NetFlow Collection Engine performs the following functions:
•NetFlow data collection from multiple export devices
•Reduction in data volume through filtering and aggregation
•Hierarchical data storage (helps client applications retrieve data)
•File system space management
Exported NetFlow data
Router A Router B
Switch 1
CNS NetFlow Collection
Engine workstation
Router C
12296

1-5
Cisco CNS NetFlow Collection Engine User Guide, Release 5.0.2
OL-6899-01
Chapter 1 Overview
CNS NetFlow Collection Engine Architectural Overview
CNS NetFlow Collection Engine collects and summarizes (aggregates) data into data files based on
user-defined criteria specified in a CNS NetFlow Collection Engine aggregator. An aggregator is an
aggregation task defined by a set of user-configurable attributes that specify how CNS NetFlow
Collection Engine summarizes the traffic flows that are received. Two important aggregator attributes
are:
•Aggregation schemes – defines the subset of data of interest in a traffic flow, as well as which
statistics are kept
•Filter – criteria for accepting or rejecting flows that are aggregated or summarized
CNS NetFlow Collection Engine provides a set of predefined aggregation schemes to help you collect
NetFlow export data and summarize the data (that is, aggregate the flows). You can choose one or more
of these aggregation schemes to customize CNS NetFlow Collection Engine for your operating context.
Moreover, in Release 5.0 you can modify any of the predefined aggregation schemes or define your own
aggregation schemes based on them. You can also use filters with aggregation schemes to include or
exclude certain types of NetFlow data.
For more information about threads, aggregation schemes, and filters, see Chapter 4, “Customizing the
CNS NetFlow Collection Engine,” in the CNS NetFlow Collection Engine User Guide.
CNS NetFlow Collection Engine Architectural Overview
CNS NetFlow Collection Engine consists of the following components:
•Collector
•Web-based User Interface (UI)
•CNS/XML Interface
•Reporting engine
•Border Gateway Protocol (BGP) Peer
These subsystems work together to provide CNS NetFlow Collection Engine functionality, including
data collection, the user interface, configuration and control, and reporting. They also allow custom
client applications to interface with CNS NetFlow Collection Engine. See Figure 1-2 for a graphical
representation of the CNS NetFlow Collection Engine system architecture.

1-6
Cisco CNS NetFlow Collection Engine User Guide, Release 5.0.2
OL-6899-01
Chapter 1 Overview
CNS NetFlow Collection Engine Architectural Overview
Figure 1-2 CNS NetFlow Collection Engine System Architecture
Collector
The Collector subsystem collects NetFlow data, aggregates (or summarizes) that data, and filters
specified data from supported Cisco routers and switches. Output is stored in files that are organized in
an easy-to-use directory structure.
Web-Based User Interface
The Web-Based User Interface is provided for configuration, control, status, and reporting.
CNS/XML interface; events
Aggregated data
reports
CNS integration bus
Events
Events
NFC 5.0
Collector
(FTP, NFS)
(FTP)
Netflow NDE
Report
generator
PerfE
(PE-PE reports)
111654
3rd party
applications
Web-based
user interface
(Tomcat)

1-7
Cisco CNS NetFlow Collection Engine User Guide, Release 5.0.2
OL-6899-01
Chapter 1 Overview
CNS NetFlow Collection Engine Architectural Overview
CNS/XML Interface
The CNS/XML Interface is used to send and receive configuration/control requests and responses, and
unsolicited event notifications. The CNS/XML interface uses the CNS Integration Bus to communicate
with clients.
Report Generator
The Report Generator produces hourly and daily reports based on Collector output files by performing
further aggregation of the records in these files based on criteria selected by the user.
BGP Peer
A passive BGP peer is provided for supplementing CNS NetFlow Collection Engine output with BGP
attributes.

1-8
Cisco CNS NetFlow Collection Engine User Guide, Release 5.0.2
OL-6899-01
Chapter 1 Overview
CNS NetFlow Collection Engine Architectural Overview