Cisco

Cisco administration 101: Monitor network traffic with NetFlow

David Davis introduces you to NetFlow, a standard for network traffic analysis. He shows you how you can use it to see the utilization on a router -- as well as the traffic that's causing the utilization.

Let's say you want to begin collecting historical data about the network traffic flowing across your network. Perhaps you want to create charts and graphs of network utilization over time, maybe you want to charge back departments that are using the most network traffic or maybe you just want to monitor link utilization over time.

If any of these network accounting scenarios sound appealing, you should familiarize yourself with Cisco's NetFlow technology. Let's take a closer look.

What is NetFlow?

NetFlow is a proprietary Cisco protocol, and all current Cisco routers and switches support this protocol. These devices record all traffic that traverses the network links and send detailed information concerning that traffic to a NetFlow collector using UDP packets.

NetFlow is the new standard for network traffic analysis; SNMP management just isn't sufficient anymore. Using NetFlow, you can see the utilization on a router -- as well as the traffic that's causing the utilization.

What exactly defines a "flow"? According to Cisco, a flow is a unidirectional sequence of packets that share the following pieces of information:

  • Source IP address
  • Destination IP address
  • Source port number
  • Destination port number
  • Protocol

Because there are five components required to define a flow, Cisco calls this the 5-tuple (quintuple) traffic definition. Specific uses for NetFlow include network monitoring, application monitoring, user monitoring, network planning, security analysis, accounting and billing, and network traffic data warehousing and mining.

What's a NetFlow collector?

While it's great to be able to collect all this data, you really want to be able to do more than that. To fully take advantage of the information, you need to actually analyze the statistics.

The first step is retrieval. How can you retrieve all this important gathered data? Enter the NetFlow collector. This is a PC/server system that sits on the network and collects all the data sent by the routers and switches.

To collect and analyze this data, you also need software. There are plenty of NetFlow applications available at a range of prices. It all depends on what you want to do and how many devices you have.

One example of an application that uses NetFlow is the Cisco Security Monitoring, Analysis and Response System (MARS). Using the NetFlow data obtained from network devices, MARS watches the network and responds to security events.

Cisco offers a list of third-party NetFlow applications on its Web site. In addition, it also lists freeware NetFlow software. One of the lesser expensive NetFlow applications is PRTG. You can use NetFlow with PRTG for about $400-$250 for the enterprise license and $150 per NetFlow device.

Does my router have NetFlow capabilities?

If you're wondering whether you can use NetFlow on your existing router or switch, you can use the Cisco Feature Navigator to determine which IOS is required. However, in general, to determine whether a device already has NetFlow, you can use the ip flow? command while in Global Configuration Mode. Here's an example:

Router# conf t

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)# ip flow?

flow-aggregation flow-cache flow-export

Router(config)# ip flow

If you see options like those listed above, your device should have the ability to send NetFlow data to a NetFlow collector. For more information, check out Cisco's Configuring NetFlow documentation.

For more information, check out Cisco's NetFlow Web page, which features an animated overview of how NetFlow works. For more in-depth technical information on NetFlow, check out Cisco's NetFlow Services Solutions Guide.

David Davis has worked in the IT industry for 15+ years and holds several certifications, including CCIE, CCNA, CCNP, MCSE, CISSP, VCP. He has authored hundreds of articles and numerous IT training videos. Today, David is the Director of Infrastructure at Train Signal.com. Train Signal, Inc. is the global leader in video training for IT Professionals and end users.

12 comments
donthomas143
donthomas143

NetFlow is useful for any type of network, be it a single device to 100's of devices. You can enable netflow on the devices, and monitor the flows using any flow collector. As far as flow collectors are concerned, try the Manageengine. The netflow analyzer has good features and is affordable. it even has a free edition where no data is ever deleted.

Stephen.Dubos
Stephen.Dubos

Netflow is very handy, we also use it to track some of our QOS traffic as it travereses our links by DSCP markings.

Michael Kassner
Michael Kassner

I agree that the application is well positioned. Some may say it's out of date and there are open source and free applications that are as good. For example, I use NetFlow , yet have not been able to rebuff my friends, with their open source and free options.

rjstephan
rjstephan

Say I have only 1 or 2 Cisco switches (~50 nodes), does NetFlow provide any benefit over the Cisco web interface. I can get a fair bit O'switch health and utilization information there.

essickj
essickj

We use Fluke Enterprise Performance Center which consists of Reporter Analyzer and Super Agent and a collector and harvester. It is VERY GOOD stuff. It will show the top users on a LAN, how much band width is being used on the WAN, how long it takes a server to respond to a request, how long it takes to get to the server and back to the requester. If your network department is at odds with the programming department and customers about the network being slow, this is the tool to use. It is not inexpensive, but well worth the cost. So far our organization is kinda small, only 27,000 employes, and about 200 work locations, with Cisco routers and switches, and growing.

IT cowgirl
IT cowgirl

Use can use the free MRTG on an older computer/server/laptop lying around to gather and keep the data. The you can keep histories to know when your peak network usage is and how much, so you can predict any extreme bandwidth usage. That way you can use it as proof for the need to purchase more bandwidth when the need arises. Also, leaving the web interface open/available can be a security risk you cannot afford! Have fun!

FAST!!!
FAST!!!

You call "only 27,000 employes, and about 200 work locations" - "kinda small". Are you kidding me! This organization sounds rather LARGE to me...

Douglas Choma
Douglas Choma

Netflow is very useful even for small networks. I just started using it to see who the bandwidth hogs are and what they're using it for. The trick is to find a useful tool for collecting/analyzing the flow data. Most of the commercial tools seem to be very expensive and geared toward large enterprises.

erikp
erikp

Scrutinizer from www.plixer.com is a low cost, high power, netflow/sflow analyzer. Free version keeps 24 hours of data. Full Disclosure: I am a developer working for Plixer. I disagree with the notion that Netflow is a 5-tuple. Most (including myself) consider Netflow to be at least a 6-tuple. Missing from the five mentioned in this article is the TOS byte in the packet header. Often referred to as QOS. Sometimes included is ingress interface making it a 7-tuple. In Scrutinizer we give the option to group by interface or not. I hope this helps, -Erik

mlisinski
mlisinski

Very good, store data in db, free - GNU General Public License .

dforcey
dforcey

Did you find something useful for small networks that didn't cost a bundle?

Editor's Picks