Enterasys Matrix N1 User manual
February 26, 2008 Page 1 of 19
NetFlow Configuration
ThisdocumentdescribestheNetFlowfeatureanditsconfigurationonEnterasysswitch/routers.
What Is NetFlow?
NetFlowisaflow‐baseddatacollectionprotocolthatprovidesinformationaboutthepacketflows
beingsentoveranetwork.NetFlowcollectsdatabyidentifyingunidirectionalIPpacketflows
betweenasinglesourceIPaddress/portandasingledestinationIPaddress/port,usingthesame
Layer3protocolandvaluesfoundinafixedsetofIPpacketfieldsforeachflow.NetFlowcollects
identifiedflowsandexportsthemtoaNetFlowcollector.ANetFlowmanagementapplication
retrievesthedatafromthecollectorforanalysisandreportgeneration.
Why Would I Use It in My Network?
Standardsystemfeedbackissimplynotgranularenoughtoprovideforsuchnetwork
requirementsasplanning,userorapplicationmonitoring,securityanalysis,anddatamining.For
example,becauseofitsabilitytoidentifyandcapturenetworkflows,NetFlow:
•Providesameanstoprofileallflowsonyournetworkoveraperiodoftime.Anetworkprofile
providesthegranularityofinsightintoyournetworknecessaryforsuchsecurenetwork
functionalityasestablishingroleswithpolicyandapplyingQoStopolicy.
•ProvidesameansofisolatingthesourceofDoSattacksallowingyoutoquicklyrespondwith
apolicy,ACL,QoSchange,orallofthesetodefeattheattack.
•Canidentifythecauseofanintermittentlysluggishnetwork.Knowingthecauseallowsyouto
determinewhetheritisanunexpected,butlegitimate,networkusagethatmightbe
rescheduledforlowusagetimeblocks,ormaybeanillegitimateusageofthenetworkthatcan
beaddressedbyspeakingtotheuser.
For information about... Refer to page...
What Is NetFlow? 1
Why Would I Use It in My Network? 1
How Can I Implement NetFlow? 2
Understanding Flows 3
Configuring NetFlow on the Enterasys Matrix DFE 6
Configuring NetFlow on the Matrix X Core Router 10
Terms and Definitions 13
NetFlow Version 5 Record Format 14
NetFlow Version 9 Templates 15
How Can I Implement NetFlow?
February 26, 2008 Page 2 of 19
•Canlookintotheflowsthattransitthenetworklinks,providingameansofverifyingwhether
QoSandpolicyconfigurationsareappropriatelyconfiguredforyournetwork.
•Canunderstandyournetwork’sflowcharacteristics,allowingforbetterplanningwhen
transitioningtonewapplicationsorservices.
How Can I Implement NetFlow?
Havingaprofileofcapturedflowsthattransityournetworkovertimeisacrucialfirststepin
implementingasecurenetwork.ThisNetFlowprofileprovidesyouwithagoodunderstandingof
theactualgroupandindividualbehaviorsthatmakeuptherolesyousetbypolicyandtowhich
youapplyQoS.Aprofilecanalsobeveryhelpfulinsituations,suchasprojectinghowanetwork
mightreacttotheintroductionofanewapplicationpriortoactualimplementation.Figure 1
illustratesanexampleofaNetFlownetworkprofilesetup.
Figure 1 NetFlow Network Profile Example
TocompleteaNetFlownetworkprofile,enableNetFlowonallportswherepacketflows
aggregate.AtthetopofFigure 1youwillfindanabbreviatedsampleoftheindependentflow
recordsthatarecapturedateachNetFlow‐enabledport.Theseflowrecordswillberetained
Understanding Flows
February 26, 2008 Page 3 of 19
locallyinacacheuntilaflowexpirationcriteriahasbeenmet.Asshown,NetFlowexportpackets
aresenttotheNetFlowcollectorserver,whereacollectorandmanagementapplicationhasbeen
installed.Themanagementapplicationwillprocesstherecordsandgenerateusefulreports.These
reportsprovideyouwithaclearpictureoftheflowsthattraverseyournetwork,baseduponsuch
datapointsassourceanddestinationaddress,startandendtime,application,andpacketpriority.
Thefollowingstepsprovideahigh‐leveloverviewofaNetFlowimplementation:
1. DeterminethebusinessornetworkpurposeoftheinformationNetFlowwillprovideyou.
2. ChooseacollectorandDragonSecurityCommandConsole(DSCC)orthird‐party
managementapplication(s)bestsuitedforthepurposeyouarecollectingthedata.Installthe
application(s)ontheNetFlowcollectorserver.
3. IdentifythepathsusedbythedatatobecollectedbyNetFlow.
4. Identifythe“chokepoint”interfaceswheretheIPpacketflowsyouwantNetFlowtocapture
aggregate.
5. EnableNetFlowontheidentifiedinterfaces.
6. IdentifytheNetFlowcollectorserverbyconfiguringitsIPaddress.
7. UsethedatareportinggeneratedbytheNetFlowmanagementapplicationtoaddressthe
purposedeterminedinstep1.
Understanding Flows
TheconceptofaflowiscriticaltounderstandingNetFlow.AflowisastreamofIPpacketsin
whichthevalueofafixedsetofIPpacketfieldsisthesameforeachpacketinthestream.Aflowis
identifiedbysevenkeyfieldsinanIPpacket:
•Sourceinputinterface
•SourceIPaddress
• DestinationIPaddress
• Destinationport(UDP/TCPportnumber)
•Sourceport(UDP/TCPportnumber)
•IPTOSfield
•Layer3protocol
Eachpacketcontainingthesamevalueforallofthesefieldsisconsideredpartofthesameflow,
untilflowexpirationoccurs.Ifapacketisviewedwithanykeyfieldvaluethatisdifferentfrom
anycurrentflow,anewflowisstartedbaseduponthekeyfieldvaluesforthatpacket.The
NetFlowprotocolwilltrackaflowuntilanexpirationcriteriahasbeenmet,uptoaconfigured
numberofcurrentflows.
Eachflowhasdifferentdata,basedontheNetFlowexportversionformatsupportedbythe
networkdevice.Thisdatacanincludesuchitemsaspacketcount,bytecount,destinationinterface
index,startandendtime,andnexthoprouter.
Flow Expiration Criteria
FlowsarenotexportedbythenetworkswitchtotheNetFlowcollectoruntilexpirationtakes
place.Therearetwotimersthataffectflowexpiration:theNetFlowactiveandinactivetimers.
Understanding Flows
February 26, 2008 Page 4 of 19
Theactivetimerdeterminesthemaximumamountoftimealonglastingflowwillremainactive
beforeexpiring.Whenalonglastingactiveflowexpires,duetotheactivetimerexpiring,another
flowisimmediatelycreatedtocontinuetheongoingflow.Itistheresponsibilityofthe
managementapplication,ontheNetFlowcollector,torejointhesemultipleflowsthatmakeupa
singlelogicalflow.TheactivetimerisconfigurableintheCLI(seeConfiguringtheActiveFlow
ExportTimeronpage 6).
TheinactivetimerdeterminesthelengthoftimeNetFlowwaitsbeforeexpiringtheflowoncea
flowhasstopped.Theinactivetimerisafixedvalueof40secondsandcannotbeconfigured.
RulesforexpiringNetFlowcacheentriesinclude:
•Flowswhichhavebeenidlefor40seconds(fixedvalueinfirmware)areexpiredandremoved
fromthecache.
• Longlivedflowsareexpiredandremovedfromthecache.(Flowsarenotallowedtolivemore
than30minutesbydefault;theunderlyingpacketconversationremainsundisturbed).
•Flowsassociatedwithaninterfacethathasgonedownareautomaticallyexpired.
Figure 2providesagraphicdepictionofhowthesetimersinteract.Flows1and3showasingle
longlastinglogicalflow.Flow1timesoutandexpiresat30minutes,theactivetimerlength.
Becausetheflowexpires,anexportpacketissenttotheNetFlowcollector.Flow3continuesthis
longlastingflowforanother10minutes.Attime40minutestheflowends.The40secondinactive
timerinitiatesandexpiresat40minutesand40secondsresultinginanexportpackettothe
NetFlowcollectorforflow3.AttheNetFlowcollector,themanagementapplicationjoinsthetwo
flowsintoasinglelogicalflowforpurposesofanalysisandreporting.
Flow2isa7.5‐minuteflowthatneverexpirestheactivetimer.Itbeginsat2.5minutesandendsat
10minutes.At10minutestheinactivetimercommencesandexpirestheflowat10minutesand40
seconds.Atthistime,NetFlowsendsanexportpacketfortheflowtotheNetFlowcollectorfor
processing.
Understanding Flows
February 26, 2008 Page 5 of 19
Figure 2 Flow Expiration Timers
Deriving Information from Collected Flows
Onthecollectionserver,athird‐partyNetFlowcollectorapplicationcorrelatesthereceived
recordsandpreparesthemforusebytheNetFlowmanagementapplication.(Insomecasesthe
collectorandmanagmentapplicationsarebundledinasingleapplication.)Themanagement
applicationretrievestheflowrecords,combinesflowsthatwerebrokenupduetoexpiration
rules,andaggregatesflowsbaseduponcommonvalues,beforeprocessingthedataintouseful
reportsviewablebythenetworkadministrator.
Correlatedreportscanbethebasisforsuchinformationcategoriesas:
• Understandingwhoisoriginatingandreceivingthetraffic
•Characterizingtheapplicationsthatareutilizingthetraffic
• Examiningflowsbypriority
•Characterizingtrafficutilizationbydevice
• Examiningtheamountoftrafficperport
Configuring NetFlow on the Enterasys Matrix DFE
February 26, 2008 Page 6 of 19
Configuring NetFlow on the Enterasys Matrix DFE
TheMatrixN‐SeriesDFEs(Gold,Platinum,andDiamond)allsupportNetFlow.NetFlowis
disabledbydefaultonalldevicesatdevicestartup.
ThissectioncoversthefollowingNetFlowconfigurationtopics:
•EnterasysMatrixDFEImplementation
•ConfiguringtheActiveFlowExportTimer
•ConfiguringtheNetFlowCollectorIPAddress
•ConfiguringtheNetFlowExportVersion
•ConfiguringNetFlowExportVersionRefresh
•ConfiguringaNetFlowPort
•ConfiguringtheNetFlowCache
•DisplayingNetFlowConfigurationandStatistics
Enterasys Matrix DFE Implementation
TheMatrixDFEflow‐basedarchitectureprovidesapowerfulmechanismforcollectingnetwork
flowstatistics,withreportingcapacitythatscaleswiththeadditionofeachDFEmodule.Foreach
flow,packetandbytecountstatisticsarecollectedbytheDFEforwardinghardware.Theflow
reportgenerationlogicisdistributed,permittingeachmoduletoreportflowsonitsownports.
TheMatrixDFEimplementationenablesthecollectionofNetFlowdataonbothswitchedand
routedframes,allowingDFEmodulesinallareasofanetworkinfrastructuretocollectandreport
flowdata.RoutingdoesnotneedtobeenabledtoutilizeNetFlowdatacollection.Flowdetail
dependsonthecontentoftheframeandthepaththeframetakesthroughtheswitch.
NetFlowcanbeenabledonallportsonaMatrixsystem,includingfixedfrontpanelports,LAG
ports,NEMports,andFTM1backplaneports.RouterinterfaceswhichmaptoVLANsmaynotbe
enableddirectly.
NetFlowrecordsaregeneratedonlyforflowsforwhichahardwareconnectionhasbeen
established.Aslongasthenetworkconnectionexists(andNetFlowisenabled),NetFlowrecords
willbegenerated.Flowsthatareswitchedinfirmware(softforwarded)willnothaveNetFlow
recordsreported.Forflowsthatarerouted,theDFEfirmwarereportsthesourceanddestination
ifIndexesasthephysicalports,notroutedinterfaces.
InthecaseofaLAGport,themodule(s)thatthephysicalportsareonwillgenerateNetFlow
recordsindependently.Theywillhowever,reportthesourceifIndexastheLAGport.TheFlow
SequenceCounterfieldintheNetFlowHeaderisuniquepermodule.TheEngineIDfieldofthe
NetFlowHeaderisusedtoidentifyeachuniquemodule.
TheMatrixN‐SeriesDFErequires256MBofmemoryinallmodulesinachassisrunning5.41.xx
firmwareandabovetoenableNetFlow.
Configuring the Active Flow Export Timer
Theactiveflowtimer,alsoreferredtoastheexportinterval,setsthemaximumamountoftimean
activeflowwillbeallowedtocontinuebeforeexpirationforthissystem.Shouldtheactivetimer
expireandtheflowterminate,theunderlyingflowcontinuesasaseparateflow.Itisthe
Configuring NetFlow on the Enterasys Matrix DFE
February 26, 2008 Page 7 of 19
responsibilityofthemanagementapplicationtorecognizethemultipleflowsasasinglelogical
flowforanalysisandreportingpurposes.Theactiveflowtimerdefaultsto30minutes.
Usethesetnetflowexport‐intervalintervalcommandtochangetheactiveflowtimervaluefor
eachsystem.
Usetheclearnetflowexport‐intervalcommandtoresettheactiveflowtimertoitsdefaultvalue.
Configuring the NetFlow Collector IP Address
ExpiredNetFlowrecordsarebundledintoNetFlowexportpacketsandsenttotheNetFlow
collectorusingtheUDPprotocol.ConfiguringtheIPaddressoftheNetFlowcollectordestination
determineswhereexpiredNetFlowrecordsforthissystemaresent.OnlyoneNetFlowcollector
maybeconfiguredforeachsystem.MultiplesystemsmayshareasingleNetFlowcollector.You
canoptionallyspecifytheUDPporttobeusedontheNetFlowcollector.Bydefault,noNetFlow
collectorisconfiguredonasystem.
IfaNetFlowcollectorhasalreadybeenconfiguredforthesystemandyouwishtochangethe
addresstoadifferentcollector,youmustfirstclearthecurrentNetFlowcollectorconfiguration,
beforeattemptingtoconfigurethenewNetFlowcollector.
Usethesetnetflowexport‐destination[ip‐address[udp‐port]]commandtoconfiguretheIP
addressoftheNetFlowcollectorforthissystemandoptionallysettheUDPport.
Usetheclearnetflowexport‐destination[ip‐address[udp‐port]]commandtoclearthecurrent
NetFlowcollectorconfiguration.
Configuring the NetFlow Export Version
TheEnterasysMatrixN‐SeriessupportsNetFlowexportversions5and9.Thedefaultexport
versionis5.
Theprimarydifferencebetweenthetwoversionsisthatversion5isafixeddatarecordwithout
multicastsupport,whereversion9isaflexible,extensible,template‐baseddatarecordthat
providesthecompleteifIndexvalueand64‐bitcounters.
WithNetFlowversion5,packetsaremadeupofaseriesofdatarecordsandareexportedtothe
collectionserverwhenthemaximumnumberofNetFlowrecordsisreached.
WhentransmittingNetFlowVersion5reports,theDFEmoduleuses“NetFlowinterface”indexes.
NormallythesewouldbeactualMIB‐2ifIndexvalues,buttheVersion5recordformatlimitsthe
valuesto2bytes,whichisnotsufficienttohold4‐byteifIndexes.NetFlowcollectorapplications
thatusethein/outinterfaceindexestogatherSNMPdataabouttheinterface(suchasifName)
musttranslatetheinterfaceindexesusingtheEnterasysMIBetsysNetFlowMIB
(1.3.1.6.1.4.1.5624.1.2.61).
WithNetFlowversion9,packetsaremadeupoftemplatesand/ordatarecords.Templatesaresent
aftertheperiodconfiguredforthetemplatetimeoutwhenamoduleorcollectionserverfirstboots
up.Datarecordsforversion9cannotbeprocessedwithoutanup‐to‐datetemplate.Collectors
ignoreincomingpacketsuntilatemplatearrives.Templatesarerefreshedperiodicallybasedupon
apacketrefreshrateandtimeoutperiod.SettingtheappropriaterefreshrateforyourMatrix
Notes: Some NetFlow management applications expect to see export packets prior to some set
interval that is often as low as 1 minute. Check the documentation for your management
application and make sure that the active flow timer is configured for a value that does not exceed
that value.
Configuring NetFlow on the Enterasys Matrix DFE
February 26, 2008 Page 8 of 19
systemmustbedetermined,sincethedefaultsettingsofa20‐packetrefreshrateanda30‐minute
timeoutmaynotbeoptimalforyourenvironment.SeeConfiguringNetFlowExportVersion
Refresh.
NetFlowVersion9recordsgeneratedbyDFEmodulesusetrueMIB‐2ifIndexvaluessincethe
templatemechanismpermitstransmissionof4‐byteifIndexes.Version9alsouses8‐bytepacket
andbytecounters,sotheyarelesslikelytorollover.Checkwithyourcollectorproviderto
determineiftheyprovidethenecessarysupport.
ThecurrentVersion9implementation:
•Doesnotsupportaggregationcaches.
•Providesfourpredefinedtemplates.Theappropriatetemplateisselectedforeachflow
dependingonwhethertheflowisroutedorswitched,andwhetheritisaTCP/UDPpacketor
not.SeeTable 5onpage 15foracompletelistingofthefieldsforeachoftheNetFlowVersion
9supportedtemplates.
Usethesetnetflowexport‐version{5|9}commandtosettheNetFlowexportversion.
Usetheclearnetflowexport‐versioncommandtoresettheexportversiontothedefaultvalue.
Configuring NetFlow Export Version Refresh
Version9templaterecordshavealimitedlifetimeandmustbeperiodicallyrefreshed.Templates
areretransmittedwheneither
•thepacketrefreshrateisreached,or
•thetemplatetimeoutisreached.
Templaterefreshbasedonthetimeoutperiodisperformedoneverymodule.SinceeachDFE
modulehandlesitsownpackettransmissions,templaterefreshbasedonnumberofexport
packetssentismanagedbyeachmoduleindependently.
TherefreshratedefinesthemaximumdelayaneworrestartedNetFlowcollectorwould
experience,beforeitlearnstheformatofthedatarecordsbeingforwarded(fromthetemplate
referencedbythedatarecords).RefreshratesaffectNetFlowcollectorsduringtheirstartup.
Collectorsmustignoreincomingdataflowreportsuntiltherequiredtemplateisreceived.
Thedefaultbehaviorisforthetemplatetobesentafter20exportdatapacketsaresent.Sincedata
recordpacketsaresentoutperflow,alongFTPflowmaycausethetemplatetimeouttimerto
expirebeforethemaximumnumberofpacketsaresent.Inanycasearefreshofthetemplateis
sentattimeoutexpirationaswell.
SettingtheappropriaterefreshrateforyourEnterasysMatrixsystemmustbedetermined,
becausethedefaultsettingsofa20‐packetrefreshrateanda30‐minutetimeoutmaynotbe
optimalforyourenvironment.Forexample,aswitchprocessinganextremelyslowflowrateof,
say,20‐packetsperhalfhour,wouldrefreshthetemplatesonlyeveryhalfhourusingthedefault
settings,whileaswitchsending300flowreportpacketspersecondwouldrefreshthetemplates
15timespersecond.
EnterasysrecommendsthatyouconfigureyourEnterasysMatrixsystemsoitdoesnotrefresh
templatesmoreoftenthanoncepersecond.
Usethesetnetflowtemplate{[refresh‐rate#ofPackets][timeoutminutes]}tosettheNetFlow
exporttemplaterefreshrateandtimeoutforthissystem.
Usetheclearnetflowtemplate{[refresh‐rate][timeout]}toresettheNetFlowexporttemplate
refreshrateandtimeouttothedefaultvalues.
Configuring NetFlow on the Enterasys Matrix DFE
February 26, 2008 Page 9 of 19
Configuring a NetFlow Port
NetFlowrecordsareonlycollectedonportsthatareenabledforNetFlow.
Usethesetnetflowportport‐stringenablecommandtoenableNetFlowonthespecifiedports.
Usethesetnetflowportport‐stringdisablecommandtodisableNetFlowonthespecifiedports.
Usetheclearnetflowportport‐stringcommandtosettheporttothedefaultvalueofdisabled.
Configuring the NetFlow Cache
EnablingtheNetFlowCachegloballyenablesNetFlowonallDFEmodulesforthissystem.When
NetFlowrecognizesanewflowontheingressport,itcreatesaNetFlowrecordforthatflow.The
NetFlowrecordresidesintheNetFlowcacheforthatportuntilanexpirationeventistriggeredfor
thatflow,atwhichtimeitissentalongwithotherexpiredflowsinanexportpackettothe
NetFlowcollectorforprocessing.
UsethesetnetflowcacheenablecommandtoenableNetFlowonthissystem.
UsethesetnetflowcachedisablecommandtogloballydisableNetFlowonthissystem.
UsetheclearnetflowcachecommandtoresettheNetFlowcachetothedefaultvalueofdisabled
forthisDFEmodule.
Displaying NetFlow Configuration and Statistics
Usetheshownetflowcommandtodisplaythecurrentconfigurationandexportstatisticsforthis
system.
Usetheshownetflowconfigport‐stringcommandtodisplaytheNetFlowconfigurationfora
singleorsetofports.
Usetheshownetflowstatisticsexportcommandtodisplayexportstatisticsforthissystem.
Procedure 1providesaCLIexampleofaNetFlowsetup.Steps1–3arerequired.Steps4–6are
optionaldependingupontheneedsofyourconfiguration.
Procedure 1 Configuring NetFlow on Matrix N-Series Systems
Step Task Command(s)
1. Enable NetFlow collection on the specified port. Matrix(rw)->set netflow port
port_string enable
2. Configure the NetFlow collector destination
server for this system.
Matrix(rw)->set netflow
export-destination ip-address
[udp-port]
3. Globally enable the NetFlow cache for this
system. Verify the required NetFlow
configuration.
Matrix(rw)->set netflow cache enable
Matrix(rw)->show netflow
4. Optionally, modify the active flow timer value for
this system.
Matrix(rw)->set netflow
export-interval interval
5. Optionally, change NetFlow record format
between version 5 and version 9 for this system.
Matrix(rw)->set netflow
export-version version
Configuring NetFlow on the Matrix X Core Router
February 26, 2008 Page 10 of 19
Default NetFlow Settings for Matrix N-Series Systems
Table 1providesalistingofthedefaultNetFlowconfigurationsettingsfortheMatrixN‐Series
systems.
Configuring NetFlow on the Matrix X Core Router
OntheMatrixXRouter,NetFlowclassificationandcachingareperformedontheInput/Output
Modules(IOMs),whileNetFlowexportfunctionalityisperformedontheControlModule(CM).
Packetsaresampledatingressattherateconfiguredforthewholesystemwiththeset
sampling‐ratecommand(seeProcedure 2onpage 11).TheIOMsclassifythesampledpackets
intoflows,updateNetFlowcounters,anddeterminetheendoftheflows.TheIOMssendflow
6. If using version 9, optionally modify the number
of export packets sent that cause a template to
be retransmitted by an individual DFE module
and/or the length of the timeout period, in
minutes, after which a template is retransmitted
by all modules in the system.
Matrix(rw)->set netflow template
{[refresh-rate packets] [timeout
minutes]
7. Verify any configuration changes made. Matrix(rw)->show netflow config
Procedure 1 Configuring NetFlow on Matrix N-Series Systems (continued)
Step Task Command(s)
Table 1 Default NetFlow Configuration Settings for Matrix N-Series Systems
Parameter Description Default Value
Cache Status Whether NetFlow caching is globally enabled or
disabled.
Disabled globally
Destination IP address The IP address of the NetFlow collector which is the
destination of the NetFlow UDP packets.
None
Export Interval The time out interval when the NetFlow cache is
flushed and the data is exported, if the maximum
number of entries has not been reached.
30 minutes
Export Version The NetFlow flow record format used when
exporting NetFlow packets. Version can be either 5
or 9.
Version 5
Inactive flow timer The number of seconds after a flow stops before
NetFlow sends an export packet for that flow to the
collector.
40 seconds
(non-configurable)
Port state Whether NetFlow is enabled or disabled on a port. Disabled
Refresh-rate The number of export packets sent before NetFlow
retransmits a template to the collector when using
NetFlow Version 9.
20 export packets
Timeout-period When using NetFlow Version 9, the number of
minutes NetFlow waits before retransmitting a
template to the collector.
30 minutes
Configuring NetFlow on the Matrix X Core Router
February 26, 2008 Page 11 of 19
datatotheCMforexportwhentheconfiguredexport‐intervaltimeexpires(defaultis30minutes)
orwhenthecacheisfull.
TheNetFlowexportprocessontheCMgathersanyfurtherdataneededtocompletethedata
recordformatfortheconfiguredNetFlowversionandsendstheflowrecordstotheconfigured
NetFlowcollector.NotethatonlyoneNetFlowexportdestination(collector)canbeconfigured
perXRoutersystem.
NetFlowcanbeenabledonanyportontheXRouter.
TheMatrixXRoutercurrentlysupportsdataexportVersion1andVersion5.CLIcommandsare
providedtoconfigurecertainrecordformatvaluesrequiredforVersion5,suchasengineIDand
enginetype.
YoumustconfigureaNetFlowexportdestinationbeforeyoucanenableNetFlowgloballyoron
anyports.NetFlowwillstartsamplingpacketsafteryouenableNetFlowgloballyandonthe
desiredports.
Disabling NetFlow
TodisableNetFlowonaport,useeitherofthefollowingcommands:
set netflow port port-string disable
Procedure 2 Configuring NetFlow on Matrix X Core Router Systems
Step Task Command(s)
1. Optionally, check the current NetFlow
configuration settings and sampling rate.
show netflow config
2. Optionally, change the sampling rate for
packets.
set sampling-rate number
3. Configure the NetFlow collector destination. You
cannot enable NetFlow globally or on ports until
an export destination has been configured.
set netflow export-destination
ip-address [udp-port]
4. Configure the administrative interface used as
the source IP address of the exported NetFlow
packets.
set netflow interface port-string
5. Configure the NetFlow flow record version to be
used for the flow data packets. Version 5 is the
default.
Optionally, also configure the BGP AS address
type. Default is peer-as.
set netflow export version {1 | 5}
[origin-as | peer-as]
6. If using Version 5, configure the engine ID and
engine type.
set netflow engine-id engine-id type
engine-type
7. Optionally, configure the export interval. The
default is 30 minutes.
set netflow export-interval min
8. Optionally, configure the maximum number of
flows that can be saved into the cache. The
default is 64 KB.
set netflow entries max-num
9. Enable NetFlow globally. set netflow cache enable
10. Enable NetFlow on the desired ports. set netflow port port-string enable
Configuring NetFlow on the Matrix X Core Router
February 26, 2008 Page 12 of 19
clear netflow port port-string
WhenyoudisableNetFlowonaport,NetFlowwillstopsamplingandthecurrentflowdatawill
beexportedwhentheexporttimeoutintervalexpires.
TodisableNetFlowglobally,useeitherofthefollowingcommands:
set netflow cache disable
clear netflow all
Whenyouexecutetheclearnetflowallcommand,allNetFlowsettingsarereturnedtotheir
defaultcondition.InthecaseoftheglobalNetFlowcachesetting,thedefaultisdisabled.
Displaying NetFlow Information
TodisplaythecurrentNetFlowconfigurationsettings:
show netflow config
TodisplayNetFlowstatisticsonaper‐portbasis:
show netflow statistics port-string
TodisplayflowcountersforthecurrentcachedNetFlowinformation,onasystem‐wideor
IOM‐specificbasis:
show netflow cache-flow [slot-id]
Default NetFlow Settings for the Matrix X Core Router
Table 2providesalistingofthedefaultNetFlowsettingsfortheMatrixXCoreRouter.
Table 2 Default NetFlow Settings for the Matrix X Core Router
Parameter Description Default Value
Cache Status Whether NetFlow caching is globally enabled or
disabled.
Disabled globally
Sampling Rate The rate at which packets are captured, or sampled.
100 indicates that 1 in 100 packets is captured.
100
Engine ID The ID number of the flow switching engine. This ID
is required by NetFlow export version 5 format.
0
Engine Type The type of flow switching engine. This value is
required by NetFlow export version 5 format.
0
Administrative Interface This is the interface used for the source IP address
of the exported NetFlow UDP datagrams.
eth0
Destination IP The IP address of the NetFlow collector which is the
destination of the NetFlow UDP packets.
None
Destination UDP port The UDP port on the NetFlow collector. 2055
Export Version The NetFlow flow record format used when
exporting NetFlow packets. Version can be either 1
or 5.
Version 5
Terms and Definitions
February 26, 2008 Page 13 of 19
Terms and Definitions
Table 3liststermsanddefinitionsusedinthisNetFlowconfigurationdiscussion.
Export Interval The time out interval when the NetFlow cache is
flushed and the data is exported, if the maximum
number of entries has not been reached.
30 minutes
Export AS Whether the BGP AS addresses are origin or peer.
BGP AS addresses are not supported by Version 1.
peer AS
Number of Entries The maximum number of flows saved into the
cache.
84 KB
Port state Whether NetFlow is enabled or disabled on a port. Disabled
Table 2 Default NetFlow Settings for the Matrix X Core Router (continued)
Parameter Description Default Value
Table 3 NetFlow Configuration Terms and Definitions
Term Definition
Active Flow Timer A timer which specifies the maximum amount of time a flow may stay active. The
ongoing flow continues to be tracked as a separate flow. It is the management
application’s responsibility to join these flows for analysis/reporting purposes.
Flow A stream of IP packets that has not yet met an expiration criteria, in which the value
of a set of key fields is the same for each packet in the stream.
Flow Record A capture of information pertaining to a single flow within the NetFlow Cache based
upon data type values supported by the NetFlow version format/template.
Inactive Flow Timer A timer that determines how long a flow for which no packets are being received
remains active.
NetFlow Cache Contains the flow records for all currently active flows.
NetFlow Collector A location where a condensed and detailed history of flow information that entered
each NetFlow-enabled switch or router is archived for use by the NetFlow
management application.
NetFlow Export A transport mechanism that periodically (based upon a timer or the number of flows
accumulated in the cache) sends NetFlow data from the cache to a NetFlow collector
for data analysis.
NetFlow Export
Packet
A packet of flow records or version 9 templates (or both) that is periodically sent to
the NetFlow collector based upon an export criteria.
NetFlow
Management
Application
A Dragon Security Command Console (DSCC) or third-party software application(s)
installed on the NetFlow collector, with client or browser access from a PC, capable
of data reduction, monitoring, analysis, and/or troubleshooting specific to the
purpose you are using NetFlow.
NetFlow Version Primarily determines the data types supported and whether the format is fixed or in
an extensible template.
NetFlow Version 5 Record Format
February 26, 2008 Page 14 of 19
NetFlow Version 5 Record Format
Table 4providesalistinganddescriptionfortheNetFlowversion5headerfieldsanddatarecord
format.Thecontentsofthesedatafieldsareusedbythecollectorsoftwareapplicationforflow
analysis.Datafieldsareidentifiedinthedatarecordpacketsentbythenetworkswitchtothe
collector.Thedatarecordscontainthevaluesspecifiedbytheformat.
Table 4 NetFlow Version 5 Template Header and Data Field Support
NetFlow Version 5 Header
Data Field Support
count Number of flows exported in this packet (1-30).
sys_uptime Current time in milliseconds since the export
device booted.
unix_secs Current count of seconds since 0000 UTC 1970.
unix_nsecs Residual nanoseconds since 0000 UTC 1970.
flow_sequence Sequence counter of total flows seen.
engine_type Type of flow-switching engine.
engine_id Slot number of the flow-switching engine.
sampling_interval First two bits hold the sampling mode; remaining
14 bits hold value of sampling interval.
count Number of flows exported in this packet (1-30).
NetFlow Version 5 Data Record Format
Data Field Support
srcaddr Source IP address of the device that transmitted
the packet.
dstaddr IP address of the destination of the packet.
nexthop IP address of the next hop router.
input SNMP index of input interface.
output SNMP index of output interface.
dPkts Number of packets in the flow.
dOctets Total number of Layer 3 bytes in the packets of
the flow.
first SysUptime at start of flow.
last SysUptime at the time the last packet of the flow
was received.
srcport TCP/UDP source port number or equivalent.
dstport TCP/UDP destination port number or equivalent.
pad1 Unused (zero) bytes.
tcp_flags Cumulative OR of TCP flags.
NetFlow Version 9 Templates
February 26, 2008 Page 15 of 19
NetFlow Version 9 Templates
Table 5providesalistinganddescriptionfortheNetFlowversion9headerfieldsandthefourdata
recordtemplatetypessupportedbythecurrentimplementationofNetFlow.Thecontentsofthese
datafieldsareusedbythecollectorsoftwareapplicationforflowanalysis.Datafieldsare
identifiedinthetemplatesentbythenetworkswitchtothecollector.Thedatarecordscontainthe
valuesspecifiedinthetemplate.
prot IP protocol type (for example, TCP = 6; UDP =
17).
tos IP type of service (ToS).
src_as Autonomous system number of the source,
either origin or peer.
dst_as Autonomous system number of the destination,
either origin or peer.
src_mask Source address prefix mask bits.
dst_mask Destination address prefix mask bits.
pad2 Unused (zero) bytes.
Table 4 NetFlow Version 5 Template Header and Data Field Support (continued)
Table 5 NetFlow Version 9 Template Header and Data Field Support
NetFlow Version 9 Header
Data Field Support
Format Version 9
Flow Record Count The total number of records in the export packet,
which is the sum of the options flow set records,
template flowset records, and data flowset
records.
Sys Up Time Time in milli-seconds since this device was first
booted.
Unix Seconds Time in seconds since 0000 UTC 1970, at which
the export packet leaves the exporter.
Flow Sequence Counter Incremental sequence counter of all export
packets sent from the exporter. This is an
accumulative count that lets the collector know if
any packets have been missed.
Source ID Engine Type (1 = Line Card).
Engine ID (One based module slot number).
NetFlow Version 9 Data Record (Template 256, Switch ID)
Data Field Support
SIP (Source) IP address of the device that
transmitted the packet.
NetFlow Version 9 Templates
February 26, 2008 Page 16 of 19
DIP (Destination) IP address of the destination
device.
Dest IfIndex MIBII 32-bit ID of the interface on which the
packet was transmitted.
Source IfIndex MIBII 32-bit ID of the interface on which the
packet was received.
Packet Count The number of packets switched through this
flow.
Byte Count The number of bytes switched through this flow.
Start Time sysUptime in msec at which the first packet of
this flow was switched.
Last Time sysUptime in msec at which the last packet of
this flow was switched.
IP Protocol IP protocol for this flow.
TOS Type of service field value for this flow.
V9 NetFlow Data Record (Template 257, Next Hop ID)
Data Field Support
SIP (Source) IP address of the device that
transmitted the packet.
DIP (Destination) IP address of the destination
device.
Dest IfIndex MIBII 32-bit ID of the interface on which the
packet was transmitted.
Source IfIndex MIBII 32-bit ID of the interface on which the
packet was received.
Packet Count The number of packets switched through this
flow.
Byte Count The number of bytes switched through this flow.
Start Time sysUptime in msec at which the first packet of
this flow was switched.
Last Time sysUptime in msec at which the last packet of
this flow was switched.
IP Protocol IP protocol for this flow.
TOS Type of service field value for this flow.
Next Hop Router Specifies the BGP next-hop address.
V9 NetFlow Data Record (Template 258, Switch ID with TCP/UDP)
Data Field Support
SIP (Source) IP address of the device that
transmitted the packet.
Table 5 NetFlow Version 9 Template Header and Data Field Support (continued)
NetFlow Version 9 Templates
February 26, 2008 Page 17 of 19
DIP (Destination) IP address of the destination
device.
Dest IfIndex MIBII 32-bit ID of the interface on which the
packet was transmitted.
Source IfIndex MIBII 32-bit ID of the interface on which the
packet was received.
Packet Count The number of packets switched through this
flow.
Byte Count The number of bytes switched through this flow.
Start Time sysUptime in msec at which the first packet of
this flow was switched.
Last Time sysUptime in msec at which the last packet of
this flow was switched.
IP Protocol IP protocol for this flow.
TOS Type of service field value for this flow.
L4 Source Port TCP/UDP source port nunmber (for example,
FTP, Telnet, or equivalent)
L4 Dest Port TCP/UDP destination port nunmber (for
example, FTP, Telnet, or equivalent)
V9 NetFlow Data Record (Template 259, Next Hop ID with TCP/UDP)
Data Field Support
SIP (Source) IP address of the device that
transmitted the packet.
DIP (Destination) IP address of the destination
device.
Dest IfIndex MIBII 32- bit ID of the interface on which the
packet was transmitted.
Source IfIndex MIBII 32- bit ID of the interface on which the
packet was received.
Packet Count The number of packets switched through this
flow.
Byte Count The number of bytes switched through this flow.
Start Time sysUptime in msec at which the first packet of
this flow was switched.
Last Time sysUptime in msec at which the last packet of
this flow was switched.
IP Protocol IP protocol for this flow.
TOS Type of service field value for this flow.
Next Hop Router Specifies the BGP next-hop address.
Table 5 NetFlow Version 9 Template Header and Data Field Support (continued)
NetFlow Version 9 Templates
February 26, 2008 Page 18 of 19
L4 Source Port TCP/UDP source port nunmber (for example,
FTP, Telnet, or equivalent)
L4 Dest Port TCP/UDP destination port nunmber (for
example, FTP, Telnet, or equivalent)
Table 5 NetFlow Version 9 Template Header and Data Field Support (continued)
Enterasys Networksreservestherighttomakechangesinspecificationsandotherinformationcontainedinthis
documentanditswebsitewithoutpriornotice.ThereadershouldinallcasesconsultEnterasys Networksto
determinewhetheranysuchchangeshavebeenmade.
Thehardware,firmware,orsoftwaredescribedinthisdocumentissubjecttochangewithoutnotice.
INNOEVENTSHALLENTERASYS NETWORKSBELIABLEFORANYINCIDENTAL,INDIRECT,SPECIAL,
ORCONSEQUENTIALDAMAGESWHATSOEVER(INCLUDINGBUTNOTLIMITEDTOLOSTPROFITS)
ARISINGOUTOFORRELATEDTOTHISDOCUMENT,WEBSITE,ORTHEINFORMATIONCONTAINEDIN
THEM,EVENIFENTERASYS NETWORKSHASBEENADVISEDOF,KNEWOF,ORSHOULDHAVEKNOWN
OF,THEPOSSIBILITYOFSUCHDAMAGES.
Enterasys Networks, Inc.
50MinutemanRoad
Andover,MA01810
©2008Enterasys Networks, Inc.Allrightsreserved.
ENTERASYS,ENTERASYS NETWORKS,ENTERASYSMATRIX,ENTERASYSNETSIGHT,LANVIEW,
WEBVIEW,andanylogosassociatedtherewith,aretrademarksorregisteredtrademarksof
Enterasys Networks, Inc.,intheUnitedStatesandothercountries.
Allotherproductnamesmentionedinthismanualmaybetrademarksorregisteredtrademarksoftheirrespective
companies.
Revision History
Date Description
January 16, 2008 First Release.
February 26, 2008 Modifications due to product branding changes.
Other manuals for Matrix N1
1
This manual suits for next models
4
Table of contents
Other Enterasys Software manuals
Enterasys
Enterasys Aurorean ANG-3000 How to use
Enterasys
Enterasys ANG-1100 Series Instruction Manual
Enterasys
Enterasys GatorMIM and GatorStar User manual
Enterasys
Enterasys ANG-1000 Instruction Manual
Enterasys
Enterasys 9034385 Guide
Enterasys
Enterasys 2000 User manual
Enterasys
Enterasys Intrusion Prevention System User manual
Enterasys
Enterasys Netsight User manual
Enterasys
Enterasys Intrusion Prevention System User manual
Enterasys
Enterasys Vertical Horizon VH-2402S Programming manual
Popular Software manuals by other brands
Smart Technologies
Smart Technologies Smart Board user guide
Multitech
Multitech FaxFinder V.34 Fax Servers FF Model Series user guide
Tripp Lite
Tripp Lite WEXT3-B072016IP specification
Qlogic
Qlogic SANsurfer iSCSI HBA Manager user guide
Blackbe;rry
Blackbe;rry ENTERPRISE SOLUTION SECURITY - ENTERPRISE SOLUTION - SECURITY... overview
Blackbe;rry
Blackbe;rry PRD-10459-016 - Enterprise Server For MS... Administration guide
Multitech
Multitech RouteFinder RF550VPN quick start guide
Blackbe;rry
Blackbe;rry Sales Client for SAP CRM release note
Blackbe;rry
Blackbe;rry CLIENT FOR IBM LOTUS SAMETIME 2.5.40 - S release note
Icom
Icom rs-ba1 Quick reference guide
Blackbe;rry
Blackbe;rry Windows Live Messenger for BlackBerry Smartphones... release note
Extron electronics
Extron electronics AVT 100 user manual
