Cflowd

There are several aggregate flow types, including:

• AS matrix

• destination prefix matrix

• source prefix matrix

• prefix matrix

• protocol/port matrix

Version 8 is an aggregated export format. As individual flows are aged out of the raw flow cache, the data is added to the aggregate flow cache for each configured aggregate type. Each of these aggregate flows are also aged in a manner similar to the method in which the active flow cache entries are aged. When an aggregate flow is aged out, it is sent to the external collector in the Version 8 record format.

The Version 9 format is flexible and allows for different templates or sets of cflowd data to be sent based on the sampled traffic type and the configured template set.

Version 9 interoperates with RFC 3954, Cisco Systems NetFlow Services Export Version 9.

Version 10 is a new format and protocol that interoperates with the IETF specifications as described by the IP Flow Information Export (IPFIX) standard. Like Version 9, Version 10 uses templates to export different data elements for a flow and handle different types of data flows, such as IPv4, IPv6, and MPLS.

Version 10 interoperates with RFC 5150 and RFC 5102.

Traffic sampling does not analyze all packets received by a router. Use command options to modify the rate at which traffic is sampled and sent for flow analysis. The default sampling rate is one out of every 1000 packets.

The following data is maintained for each flow in the raw flow cache:

• source IP address

• destination IP address

• source port

• destination port

• forwarding status

• input interface

• output interface

• IP protocol

• TCP flags

• first timestamp (of the first packet in the flow)

• last timestamp (timestamp of last packet in the flow before expiry of the flow)

• source AS number for peer and origin (taken from BGP)

• destination AS number for peer and origin (taken from BGP)

• IP next hop

• BGP next hop

• ICMP type and code

• IP version

• source prefix (from routing)

• destination prefix (from routing)

• MPLS label stack from label 1 to 6

Within the raw flow cache, the following characteristics are used to identify an individual flow:

• ingress interface

• source IP address

• destination IP address

• source transport port number

• destination transport port number

• IP protocol type

• IP TOS byte

• virtual router ID

• ICMP type and code

• direction

• MPLS labels

SR OS implementation allows cflowd to be enabled at the interface level or as an action to a filter. By enabling cflowd at the interface level, all IP packets forwarded by the interface are subject to cflowd analysis. By setting cflowd as an action in a filter, only packets matching the specified filter are subject to cflowd analysis. This provides the network user greater flexibility in the types of flows that are captured.

A collector defines the export of data flows from the flow cache. The user can configure up to a maximum of eight collectors; each collector is identified by a unique IP address and UDP port value. Each collector can only export traffic in one version type: Version 5, Version 8, Version 9, or Version 10.

The command options within a collector configuration can be modified or the defaults retained.

The autonomous-system-type command defines whether the AS information included in the flow data is based on the originating AS or external peer AS of the flow.

The following common (global) attributes apply to all instances of cflowd:

• active flow timeout

  This attribute controls the maximum time a flow record can be active before it is automatically exported to defined collectors.

• inactive flow timeout

  This attribute controls the minimum time before a flow is declared inactive. If no traffic is sampled for a flow for the inactive timeout duration, the flow is declared inactive and marked to be exported to the defined collectors.

• cache size

  This attribute defines the maximum size of the flow cache.

• overflow

  This attribute defines the percentage of flow records that are exported to all collectors if the flow cache size is exceeded.

• rate

  The rate attribute defines the system-wide sampling rate for cflowd.

• template retransmit

  This attribute defines the interval (in seconds) at which the Version 9 and Version 10 template is retransmitted to all configured Version 9 or Version 10 collectors.

Cflowd is disabled by default. You must configure and enable at least one collector to be able to activate cflowd. Executing the cflowd command enables cflowd.

The following example shows the default values when cflowd is initially enabled. No collectors or collector options are configured.

[ex:/configure cflowd]
A:admin@node-2# info detail
...
    admin-state enable
...
    cache-size 65536
...
     overflow 1
...
    template-retransmit 600
...
    active-flow-timeout 1800
    inactive-flow-timeout 15
    sample-profile 1 {
...
        sample-rate 1000
    }

A:node-2>config>cflowd# info detail
----------------------------------------------
        active-flow-timeout 1800
        cache-size 65536
        inactive-flow-timeout 15
...
        overflow 1
        template-retransmit 600
...
        sample-profile 1 create
            sample-rate 1000
        exit
        no shutdown
----------------------------------------------

The following example shows the global cflowd configuration.

[ex:/configure cflowd]
A:admin@node-2# info
...
    overflow 10
...
    active-flow-timeout 1800
    inactive-flow-timeout 10
    sample-profile 1 {
        sample-rate 100
    }

A:node-2>config>cflowd# info detail
----------------------------------------------
        active-flow-timeout 1800
...
A:node-2>config>cflowd# info
----------------------------------------------
        inactive-flow-timeout 10
...
        overflow 10
        sample-profile 1 create
            sample-rate 100
        exit
----------------------------------------------

The following example shows a basic configuration of cflowd collectors.

[ex:/configure cflowd]
A:admin@node-2# info
...
    overflow 10
...
    active-flow-timeout 1800
    inactive-flow-timeout 10
    sample-profile 1 {
        sample-rate 100
    }
    collector 10.10.10.1 port 2000 {
        description "AS info collector"
        version 8
        aggregation {
            as-matrix true
            raw true
        }
    }
 collector 10.10.10.2 port 5000 {
        description "Neighbor collector"
        autonomous-system-type peer
        version 8
        aggregation {
            protocol-port true
            source-destination-prefix true
        }
    }

A:node-2>config>cflowd# info detail
----------------------------------------------
        active-flow-timeout 1800
...
A:node-2>config>cflowd# info
-----------------------------------------
        inactive-flow-timeout 10
        overflow 10
        sample-profile 1 create
            sample-rate 100
        exit
        collector 10.10.10.1:2000 version 8
            description "AS info collector"
            aggregation
                as-matrix
                raw
            exit
        exit
        collector 10.10.10.2:5000 version 8
            description "Neighbor collector"
            aggregation
                protocol-port
                source-destination-prefix
            exit
            autonomous-system-type peer
        exit

[ex:/configure cflowd]
A:admin@node-2# info
...
    collector 10.10.10.9 port 2000 {
        description "v9collector"
        template-set mpls-ip
        version 9
    }

A:node-2>config>cflowd# info
----------------------------------------------
...
        collector 10.10.10.9:2000 version 9
            description "v9collector"
            template-set mpls-ip
        exit
----------------------------------------------

When cflowd is enabled on an interface, all packets forwarded by the interface are subject to analysis according to the global cflowd configuration and sorted according to the collector configurations.

See Cflowd configuration dependencies for configuration combinations.

Use the following command to configure cflowd on an IP interface.

configure router interface cflowd-parameters sampling unicast type interface

When the preceding command is configured, the following requirements must be met to enable traffic sampling on the interface:

• Enable cflowd.

• Ensure at least one cflowd collector is configured and enabled.

• Use the commands in the following context to configure sampling as unicast or multicast, as well as the type and direction of the sampling. By default, the direction is ingress-only.

  configure router interface cflowd-parameters sampling

• Use the following commands to prevent specific types of traffic from being sampled when interface sampling is enabled. The filter must be applied to the service or network interface on which the traffic to be omitted is to ingress the system.

  • MD-CLI

    configure filter ip-filter entry interface-sample false
    configure filter ipv6-filter entry interface-sample false

  • classic CLI

    configure filter ip-filter entry interface-disable-sample
    configure filter ipv6-filter entry interface-disable-sample

Packets are matched against filter entries to determine acceptability. With cflowd, only the first packet of a flow is compared. If the first packet matches the filter criteria, an entry is added to the cflowd cache. Subsequent packets in the same flow are also sampled based on the cache entry.

Because a filter can be applied to more than one interface (when configured with a scope template), you can enable or disable traffic sampling on an interface-by-interface basis. Use the following command to disable traffic sampling:

• MD-CLI

  configure filter ip-filter entry interface-sample false

• classic CLI

  configure filter ip-filter entry interface-disable-sample

The preceding command to disable traffic sampling can be enabled or disabled as needed instead of having to create numerous filter versions.

To enable an interface for filter traffic sampling, the following requirements must be met:

• Cflowd must be enabled globally.

• At least one cflowd collector must be configured and enabled.

• Use the commands in the following context on the IP interface that is used to configure sampling as unicast or multicast. You must also select the ACL option.

  configure router interface cflowd-parameters sampling

• On the IP filter being used, you must explicitly enable filter sampling for the entries matching the traffic that should be sampled. Use the following commands to configure filter sampling for the filter:

  • MD-CLI

    configure filter ip-filter entry filter-sample true
    configure filter ipv6-filter entry filter-sample true

  • classic CLI

    configure filter ip-filter entry filter-sample
    configure filter ipv6-filter entry filter-sample

  The default is disabled. See Filter configurations for more information.

• The filter must be applied to a service or a network interface. The service or port must be enabled and operational.