Netflow: How to Set Up for Improved Bandwidth Management
Introduction
Netflow is a popular protocol, which is developed by Cisco. Its work is to collect IP traffic information flowing through an interface on the network. It monitors our computer networking devices in real-time. It defines the behavior of network traffic.
Why do we use NetFlow?
It helps us to identify some common issues like network bottlenecks. It means which user takes the most of the network bandwidth. So, it helps us to track the device which utilizes most of the bandwidth resources and we can free up those points to get rid of bottlenecks.
Netflow can detect the net applications that have been introduced in our network. It tracks the changes that have been made through network policy. It helps us to detect unauthorized or problematic traffic as well. Suppose an end user starts media streaming services that may cause congestion during work time, which should not be doing so.
Moreover, it helps in detecting network vulnerabilities and anomalies in a network such as worm detection is possible through it.
How Does It Netflow Work?
To know about the workings of NetFlow, first, we define what is IP flow. An IP flow is a network traffic which is flowing in one direction. This traffic crosses the network device in one direction and is destined for any public server or coming to our network for any single port. It examines those packets into a set of specific attributes. The packets of the same type of attributes are grouped into a flow record. The attributes that NetFlow uses to group those packets into flow are:
- IP source and destination address
- Source and destination port
- Layer 3 protocol type
- Router or Switch interface
- Type of Service
It captures the traffic, either entering the port(ingress) or leaving it (egress). It depends on how we configured it.
All packets with the same common attributes are placed into a router database called a Netflow cache.
There are two ways to access Netflow cache which are:
- Cli view
- External NetFlow collector
We use cli view via show command if we want some information immediately while troubleshooting. But, this type of cache is limited and it is not helpful for a historical view of network traffic. It is good for troubleshooting but to truly leverage all the benefits of NetFlow; we want to use a Netflow collector. The collector is a device used to receive, interpret, and store flow records. We can configure a Router or Switch to export flow records to an external collector. The collector can deeply analyze the flow records. It then shows the stored data in graphical representation for an easy visual manner.
Versions
There are a total 9 versions, but we use two main versions:
- Version 5 2) version 9
The Netflow version 5 is the most popular. It has a fixed data format which is never changing. The Netflow v9 is the newest version. Its format is dynamic. It has better analysis and security features.
Lab Topology
We will use this topology for our configuration in the Packet Tracer:
Configure R1 and R2 with basic IP address configuration and, also configure a default route on them for communication.
Configure the netflow on the Router R1. First, configure ingress and egress traffic on the interface fast ethernet 0/0. After that, export NetFlow to the server with IP address 192.168.10.10/24.
Click on the Netflow collector
First of all, click on “On” to start it.
Generate some traffic from PC1, PC2, and PC3 and examine it into the server. Open the server and click on the NetFlow collector. Wait for a few seconds, and then you will see the traffic generated by various PCs as a pie chart.
Now we are going to Ping the server from Router R2, and then check the Netflow analyzer.
