Netflow Flashcards
What is the port used by the Netflow protocol?
Netflow is UDP but it does NOT have an assigned port number. Each flow sensor will use a unique port number as designated by an admin.
What are the commands to enable basic netflow for interface Gi0/0 on a router for the destination of 10.1.0.111 using the port 9998?
FLOW(config)# int gi0/0
FLOW(config-if)# ip flow ingress
FLOW(config-if)# ip flow egress
FLOW(config)# ip flow-top-talkers
FLOW(config-flow-top-talkers)# top 5
FLOW(config-flow-top-talkers)# sort-by bytes
FLOW(config)# ip flow-export version 9
FLOW(config)# ip flow-export destination 10.1.0.111 9998
What command(s) could you use to verify the netflow is working?
show ip cache flow
show ip flow top-talkers
NOTE: Netflow data on a router expires quickly so these commands are really only good to troubleshoot if netflow is working.
When using the show commands to verify netflow, how are the source and destination port numbers displayed?
In hexadecimal format (instead of decimal)
What are the three pieces you need to configure to create flexible netflow on a router?
Flow Record
Flow Export
Flow Monitor
What two things do you need to do to configure a flow record?
1.) Define the criteria of a flow using the match command
2.) Define information you want to gather with the collect command
What two things do you need to do to configure a flow exporter?
1.) The destination collector server, using the destination command
2.) The port number for the flow sensor using the transport udp <port> command</port>
What two things do you need to configure a flow monitor?
1.) the flow record to be used with the record <NAME> command</NAME>
2.) the flow exporter to be used with the exporter <NAME> command</NAME>
Using IOS commands, configure a flexible netflow that uses source ipv4 address to collect ipv4 source, destination, and protocol information and apply it to interface gi0/0
FLOW(config)# flow record FLOW_REC_1
FLOW(config-flow-record)# description basic netflow information
FLOW(config-flow-record)# match ipv4 source address
FLOW(config-flow-record)# collect ipv4 source address
FLOW(config-flow-record)# collect ipv4 protocol
FLOW(config-flow-record)# collect ipv4 destination address
FLOW(config)# flow exporter FLOW_EXP_1
FLOW(config-flow-exporter)# description flows exported to my PRTG server A
FLOW(config-flow-exporter)# destination <flow></flow>
FLOW(config-flow-exporter)# transport udp <flow></flow>
FLOW(config)# flow monitor FLOW_MON_1
FLOW(config-flow-monitor)# exporter FLOW_EXP_1
FLOW(config-flow-monitor)# record FLOW_REC_1
FLOW(config)# int gi0/0
FLOW(config-if) ip flow monitor FLOW_MON_1 input
What show commands would you use to verify flexible netflow on a Cisco device?
show flow recorder
show flow exporter
show flow monitor
