NetFlow Export
NetFlow Export Version Formats
For all export versions, the NetFlow export datagram consists of a header and a sequence of flow records. The header contains information such as sequence number, record count, and system uptime.
The flow record contains flow information, for example IP addresses, ports, and routing information. NetFlow version 9 export format is the newest NetFlow export format. The distinguishing feature of the NetFlow version 9 export format is that it is template based. Templates make the record format extensible. This feature allows future enhancements to NetFlow without requiring concurrent changes to the basic flow-record format.
The use of templates with the NetFlow version 9 export format provides several other key benefits:
- You can export almost any information from a router or switch including Layer 2 through 7 information, routing information, IP version 6 (IPv6), IP version 4 (IPv4), multicast, and Multiprotocol Label Switching (MPLS) information. This new information allows new applications for export data and new views of network behavior.
- Third-party business partners who produce applications that provide collector or display services for NetFlow are not required to recompile their applications each time a new NetFlow export field is added. Instead, they might be able to use an external data file that documents the known template formats.
- New features can be added to NetFlow more quickly, without breaking current implementations.
- NetFlow is “future-proofed” against new or developing protocols, because the version 9 export format can be adapted to provide support for them and for other non-NetFlow-based approaches to data collection.
The work of the Internet Engineering Task Force (IETF) IP Information Export (IPFIX) Working Group (WG) and the IETF Pack Sampling (PSAMP) WG are based on the NetFlow version 9 export format.
The version 1 export format was the original format supported in the initial Cisco IOS software releases containing NetFlow functionality and is rarely used today. The version 5 export format is a later enhancement that adds Border Gateway Protocol (BGP) autonomous system information and flow sequence numbers. The version 7 export format is an enhancement that adds NetFlow support for Cisco Catalyst series switches that use hybrid or native mode. Versions 2 through 4 and version 6 export formats were either not released or are not supported. Version 8 export format is the NetFlow export format to use when you enable router-based NetFlow aggregation on Cisco IOS router platforms.
Configuring NetFlow Export (example):
ip flow-export source fastethernet0/0
ip flow-export version 5
ip flow-export destination 1.1.1.1 2055
interface fastethernet0/0
ip flow ingress
ip flow egress
ip route-cache flow
exit
