Flow statistics collection in the NFM-P

Introduction

The NFM-P can collect flow statistics from managed NEs. Although other criteria may apply, a flow is basically a series of IP packets that share a common source, destination, and type of payload, for example, traffic that is specific to an application.

When an NE is configured to collect flow statistics, the NE monitors the traffic on one or more interfaces to identify the flows, aggregates the flow data, and regularly exports flow data records to an external system.

The NFM-P uses NSP Flow Collectors to collect the IPFIX v10 (RFC 7011) flow statistics with the AA Cflowd Nokia variant from managed NEs.

Note: For information about using NSP to collect IPFIX v10 statistics with the System Cflowd or CGNAT Nokia variants, or Netflow v5 statistics, see the NSP Data Collection and Analysis Guide.

Functional description

IPFIX data is sent from routers, packaged in IPFIX messages that contain IPFIX records. Each record is a collection of fields determined by an IPFIX template. These templates are periodically sent by the routers to the collectors. IPFIX templates can be modified (fields can be removed from or added to the records). A flow collector uses these templates to decode the IPFIX records.

The fields contained in a record may include - but are not limited to - the following:

• counters

• timestamps

• delays

• quantities

• labels

• IDs

The Flow Collector generates "data types" using sets of counters that are found in IPFIX records and/or values computed based on IPFIX records. The Flow Collector collects these data types at configured intervals, then exports the collected data in various formats (IPDR binary files, CSV text files, Kafka notifications, Vertica database records).

Each data type can be aggregated in one or more ways by applying an "aggregation type" to it. Each aggregation type is defined by a set of fields from the IPFIX record (usually IDs) and, potentially, correlated information from the NFM-P database. When no aggregation is applied, the Flow Collector refers to the data as "raw" (raw aggregation). During each interval, aggregated data is collected in a memory buffer, and is exported in one of the supported formats when the interval ends.

Collected data can be exported in the following formats:

• AA Cflowd

  • Vertica database

  • IPDR binary files

  • CSV text files (for the Comprehensive Raw and PGW-EDR data types)

IPDR Reference

The NFM-P IPDR Reference lists and describes the fields in an IPDR-formatted record for each collection or aggregation domain based on user-specified criteria. The IPDR Reference also lists the IPDR schema changes between NFM-P releases.

Exporting IPDR file contents to other formats

For compatibility with an OSS application, you can use an NFM-P tool to export the contents of XDR-encoded IPDR statistics files to files in a format such as text or XML. Because the export process is resource-intensive, you must observe the following requirements before you attempt to use the tool.

• It is strongly recommended that you use the tool only on a standby NFM-P main server, whether collocated with a main database or in a distributed deployment.

• The system that receives the exported files must meet the following requirements.

  • The system must be dedicated to the export operation.

  • The output location must have sufficient space for the output files; a large network-attached storage system is recommended. An exported file is approximately six times the size of the associated input file.

• The user of the tool requires full access permissions on the input and output directories.

CLI- and GUI-based versions of the tool are available; see To export IPDR statistics files to a different format for information about how to export IPDR files.