Table of Contents Link to heading

• What NetFlow Provides
• Flow Definition and the 7-Tuple Key
• NetFlow Versions
• Traditional NetFlow vs Flexible NetFlow
• Flexible NetFlow Architecture
• Flexible NetFlow Configuration
  • Step 1 — Create a Flow Record
  • Step 2 — Create a Flow Exporter
  • Step 3 — Create a Flow Monitor
  • Step 4 — Apply to Interface
  • Verification
• Sampling
• Operational Considerations

What NetFlow Provides Link to heading

NetFlow answers operational questions that SNMP interface counters cannot:

• Which source IPs are generating the most traffic?
• Which applications (by port) are consuming bandwidth?
• Is there unexpected traffic between segments that should not be communicating?
• When did a specific flow start, and how long did it last?

This makes NetFlow foundational for capacity planning, security investigation, billing in service provider environments, and anomaly detection.

Flow Definition and the 7-Tuple Key Link to heading

A flow is a unidirectional stream of packets sharing the same set of identifying characteristics. Classic NetFlow (v5) identifies flows using a 7-tuple key — if all seven fields match, packets belong to the same flow:

A single TCP session (e.g., HTTPS from a client to a web server) generates two flows: one for each direction. NetFlow is inherently unidirectional.

NetFlow Versions Link to heading

Traditional NetFlow vs Flexible NetFlow Link to heading

Flexible NetFlow Architecture Link to heading

FNF uses a three-component modular architecture:

The monitor is applied to an interface in a specific direction (input/output). A single monitor can be applied to multiple interfaces; multiple monitors can coexist on a single interface.

Flexible NetFlow Configuration Link to heading

Step 1 — Create a Flow Record Link to heading

The flow record defines the key fields (used to identify a unique flow) and non-key fields (statistics collected per flow).

flow record CCNP-RECORD
 description IPv4 traffic with port info
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match ipv4 protocol
 match interface input
 collect counter bytes long
 collect counter packets long
 collect timestamp sys-uptime first
 collect timestamp sys-uptime last

Step 2 — Create a Flow Exporter Link to heading

The exporter defines the collector destination — the external system that receives and stores flow data.

flow exporter CCNP-EXPORT
 description Export to NetFlow collector
 destination 10.10.10.10
 transport udp 2055
 export-protocol netflow-v9
 template data timeout 60

template data timeout 60 sends the flow template to the collector every 60 seconds. Collectors need the template to decode the flow data — without it, flow records are uninterpretable.

Step 3 — Create a Flow Monitor Link to heading

The monitor binds the record and exporter and maintains the active flow cache.

flow monitor CCNP-MONITOR
 description Main traffic monitor
 record CCNP-RECORD
 exporter CCNP-EXPORT
 cache timeout active 60
 cache timeout inactive 15

• cache timeout active: export flows still in progress every 60 seconds (provides near-real-time visibility)
• cache timeout inactive: export flows that have seen no packets for 15 seconds (captures short flows quickly)

Step 4 — Apply to Interface Link to heading

interface GigabitEthernet0/0
 ip flow monitor CCNP-MONITOR input
 ip flow monitor CCNP-MONITOR output

Apply both input and output to capture traffic in both directions. On high-throughput interfaces, consider applying only input (traffic entering the device) and relying on the remote site’s monitor for the return direction.

Verification Link to heading

show flow monitor CCNP-MONITOR
show flow monitor CCNP-MONITOR cache
show flow exporter CCNP-EXPORT
show flow record CCNP-RECORD

For classic NetFlow v5 (legacy):

show ip cache flow
show ip flow export

show flow monitor CCNP-MONITOR cache displays the active flow cache — useful for real-time visibility into what flows the router is currently tracking. A cache that is consistently near its maximum size indicates either high traffic volume or a need to lower the active/inactive timeouts to flush flows faster.

Sampling Link to heading

On high-speed interfaces, analysing every packet introduces significant CPU and memory overhead. Sampling reduces this by analysing only a fraction of packets:

sampler CCNP-SAMPLER
 mode random 1 out-of 100

interface GigabitEthernet0/0
 ip flow monitor CCNP-MONITOR sampler CCNP-SAMPLER input

This configures 1-in-100 sampling — the router analyses one randomly selected packet out of every 100. Flow statistics are then extrapolated by the collector.

Operational Considerations Link to heading

Collector selection: Popular open-source options include ntopng, pmacct, and Elastic Stack with the NetFlow module. Commercial options include Cisco Stealthwatch (now Secure Network Analytics) and SolarWinds NTA.

Interface selection: Apply NetFlow at the network edge or at aggregation points rather than on every access port. Monitoring ingress on the WAN interface and egress on the LAN uplink provides visibility for most traffic patterns without the overhead of full campus deployment.

Storage: NetFlow data is compact but accumulates quickly. A 1 Gbps interface generating full-rate NetFlow v9 exports can produce several GB of collector data per day. Size collector storage based on your retention requirement — 30 days is typical for security forensics, 90+ days for capacity planning.