%include "default.mgp"
%tab bullet icon arc blue 40
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%nodefault
%bgrad 0 0 32 0 1 white blue
%xfont utopia-bold-r, size 12

%center, fore "black"
NetFlow Switching
%size 5
Router Based Statistics

%xfont courier-bold-r





drowell@cisco.com

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont utopia-bold-r
%bgrad 0 0 32 0 0 white blue
%fore black

What is NetFlow?

%fore black, size 5

&bullet IOS switching extension
&bullet Maintains per flow state
&bullet Can export flow statistics datagrams
&bullet Used to accelerate certain IP features

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont utopia-bold-r
%bgrad 0 0 32 0 0 white blue
%fore black

Uses for NetFlow Statistics

%fore black, size 5

&bullet Network planning
&bullet Billing
&bullet Troubleshooting


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont utopia-bold-r
%bgrad 0 0 32 0 0 white blue
%fore black

NetFlow's Definition of a Flow

%fore black, size 5

&bullet Same source and destination IP
&bullet Same protocol, TOS byte
&bullet Same input interface
&bullet Same ports if applicable
&bullet Has time component

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont utopia-bold-r
%bgrad 0 0 32 0 0 white blue
%fore black

NetFlow Export

%fore black, size 5

&bullet Sends UDP packets to a specified host address and port number
&bullet Each UDP packet contains a number of flow entries
&bullet Current version is V5

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont utopia-bold-r
%bgrad 0 0 32 0 0 white blue
%fore black
%center

NetFlow Export datagrams

%image "flowPacket.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont utopia-bold-r
%bgrad 0 0 32 0 0 white blue
%fore black
%center

Flow Header

%image "flowHeader.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont utopia-bold-r
%bgrad 0 0 32 0 0 white blue
%fore black
%center

Flow Entry

%image "flowEntry.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont utopia-bold-r
%bgrad 0 0 32 0 0 white blue
%fore black

CEF Based Flow Switching

%fore black, size 5

&bullet CEF is cisco's replacement for demand caching
&bullet NetFlow now uses either the CEF or the route cache for route\
 information.
&bullet Solves source AS problem
&bullet Solves host route problem

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont utopia-bold-r
%bgrad 0 0 32 0 0 white blue
%fore black

Recent changes

%fore black, size 5

&bullet More platforms
&bullet Works with ISL, LANE, etc
&bullet Sub-interface accounting in 12.0
&bullet Works distributed with export
&bullet Feature acceleration

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont utopia-bold-r
%bgrad 0 0 32 0 0 white blue
%fore black

Current development

%fore black, size 5

&bullet On the router flow aggregation
&bullet Export filtering
&bullet Reduced size export records
&bullet GSR

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont utopia-bold-r
%bgrad 0 0 32 0 0 white blue
%fore black

Router aggregation

%fore black, size 5

&bullet Predefined aggregations schemes (AS, Protocol-port, ???)
&bullet Multiple active aggregation caches with configurable export
&bullet Designed to reduce the number of export records

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont utopia-bold-r
%bgrad 0 0 32 0 0 white blue
%fore black

Next up

%fore black, size 5

&bullet More aggregation schemes
&bullet Investigate AS path export
&bullet Reliable transport

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont utopia-bold-r
%bgrad 0 0 32 0 0 white blue
%fore black

Open Questions

%fore black, size 5

&bullet What are important aggregation schemes?
&bullet Are configurable aggregation schemes useful?
&bullet How much of the AS path is really needed?
&bullet What new things would be good to have exported?

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
