Netflow version 9

Netflow version 9 is an export protocol. It doesnt change the metering process. It is supported on many cisco devices nowadays and its some kind of  common netflow standard shiped with cisco devices.

Biggest change comparing to other netflow version is that it brings the template behaviour. You can now create many templates. Every template contains specific fields (flow records) you define. Look at the picture to see netflow version 9 template structure. Every template got its ID so data collector can recognize the templates.

Capture

 

What we see above is template. The next picture is  option template. The difference is that the option template contains specific scope.

Capture

Example of options template FlowSet is ifIndex. Instead of the collector polling the ifName MIB variable for a specific ifIndex, the mathing ifIndex and ifName is sent in an option data record. Because netflow is exporting just the ifIndex and that is the name of the interface not its name. Thats why netflow needs to poll the specific MIB for the interface name.

Now look at the basic netflow cache configuration. We we need to send the template every 5 minutes or 20 packets? Because netflow uses UDP and the template can be lost. If the template is lost the collector cant decode the information. Information is flexible and you can change it everytime without changing the collector settings – this is how it is designed.

Capture