Michael Lorincz — Technical Notes

Cisco - Flexible Netflow

2 min read

Cisco Flexible NetFlow Reference

cisco netflow cheatsheet command

Overview

Flexible NetFlow (FNF) is Cisco’s evolution of traditional NetFlow. It allows custom flow record definitions instead of fixed v5/v9 formats.

Flexible vs Traditional NetFlow

FeatureTraditional NetFlowFlexible NetFlow
Record formatFixed (v5, v9)Customizable
Fields collectedPredeterminedUser-defined
Multiple exportsNoYes
Per-interface configLimitedFull control

Components

Flow Record → Flow Monitor → Interface
                 ↓
           Flow Exporter → Collector
ComponentPurpose
Flow RecordDefines what fields to collect (match/collect)
Flow ExporterDefines where to send data (collector IP, port)
Flow MonitorLinks record + exporter, applies to interface

Configuration Example

1. Create Flow Record

flow record CUSTOM-RECORD
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match ipv4 protocol
 collect counter bytes
 collect counter packets
 collect timestamp sys-uptime first
 collect timestamp sys-uptime last

2. Create Flow Exporter

flow exporter EXPORT-TO-COLLECTOR
 destination 10.1.1.100
 source Loopback0
 transport udp 2055
 export-protocol netflow-v9
 template data timeout 60

3. Create Flow Monitor

flow monitor MONITOR-TRAFFIC
 record CUSTOM-RECORD
 exporter EXPORT-TO-COLLECTOR
 cache timeout active 60
 cache timeout inactive 15

4. Apply to Interface

interface GigabitEthernet0/0
 ip flow monitor MONITOR-TRAFFIC input
 ip flow monitor MONITOR-TRAFFIC output

Common Match Fields

FieldDescription
ipv4 source addressSource IP
ipv4 destination addressDestination IP
transport source-portSource port
transport destination-portDestination port
ipv4 protocolProtocol number (TCP=6, UDP=17)
interface inputIngress interface
ipv4 tosType of service / DSCP

Common Collect Fields

FieldDescription
counter bytesByte count
counter packetsPacket count
timestamp sys-uptime firstFlow start time
timestamp sys-uptime lastFlow end time
transport tcp flagsTCP flags seen

Verification Commands

show flow monitor
show flow monitor MONITOR-TRAFFIC cache
show flow monitor MONITOR-TRAFFIC statistics
show flow record
show flow exporter
show flow exporter EXPORT-TO-COLLECTOR statistics
show flow interface

Interpret Cache Output

show flow monitor MONITOR-TRAFFIC cache format table

Shows active flows with configured fields.

Check Export Statistics

show flow exporter EXPORT-TO-COLLECTOR statistics

Look for:

  • Packets sent vs failed
  • Template packets sent
  • Client/server errors

Use Cases

Use CaseConfiguration Focus
Traffic analysisCollect bytes/packets per conversation
Security monitoringMatch on ports, look for anomalies
Capacity planningLong-term byte counters by subnet
Billing/accountingMatch interface + collect counters
Application visibilityInclude NBAR fields if supported

Troubleshooting

No Flows Exported

  1. Verify interface has ip flow monitor applied
  2. Check exporter destination is reachable
  3. Confirm UDP port isn’t blocked
  4. Check show flow exporter statistics for errors

Cache Full

Increase cache size or reduce timeouts:

flow monitor MONITOR-TRAFFIC
 cache entries 32768
 cache timeout active 30

Graph View

Backlinks