NetFlow monitoring & analysis made easy with PRTG

Creating a flow

A flow is a way of grouping a unidirectional stream of packets into a specific set. These sets can be configured based on matching attributes in each packet, including:

• IP source
• IP destination
• Source port
• Destination port
• Class of Service
• Layer 3 protocol type
• Interface

As each packet is forwarded, the respective attributes are examined. A flow is generated by the first packet passing through the standard switching path. Each additional packet with the same parameters (source and destination IP addresses, source and destination port, class of service) is grouped into a single flow. Any variation in the value of any one of the parameters creates a new flow.

NetFlow cache

Monitoring and grouping every packet forwarded by a router or switch generates a lot of data. This data is condensed into a database within the network device called the NetFlow cache. A flow record is kept for each active flow. Data is expired and then exported from the cache to a NetFlow collector server at regular intervals based on flow timers.

NetFlow export

Flows are grouped for export into a NetFlow Export datagram. Each datagram consists of up to 30 flows. According to Cisco, standard NetFlow exports use about 1.5 percent of the total analyzed switched traffic.

NetFlow record

The NetFlow v9 record is template based. The record format is defined by a packet header, followed by at least one template FlowSet and data FlowSet. The template FlowSet provides a description of what data comes with the data FlowSets.

NetFlow collector

NetFlow data is periodically reported to a NetFlow collector. The collector is a different server or computer that runs a NetFlow receiver software which is designed to gather, record, filter, and analyze the resulting flows. The collector software must support the same NetFlow version as the exporting server.

NetFlow datagrams are exported using the User Datagram Protocol (UDP). The IP address of the collector and the destination port must be configured on the router or switch itself. In some cases, SNMP can be used to turn on NetFlow and configure the collector’s IP address to send the data to.

NetFlow MIB

It is possible to access some NetFlow data via SNMP using the NetFlow MIB. While not designed to be a replacement for NetFlow export, it does offer a way to gain access to NetFlow data in a different way. The available data includes the number of flows, the flows per second, and packets or bytes per flow.

Here you can see the NetFlow Top Talkers command, which lists the largest packet and byte consumers of the network. Before you can use the Top Talkers command, you need to configure it:

Router(config)#ip flow-top-talkers
Router(config-flow-top-talkers)#top 10

The top 10 talkers in a network sorted by packets, for example, can be seen here:

R3#show ip flow top-talkers
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts
Et1/0 172.16.10.2 Et0/0 172.16.1.84 06 0087 0087 2100
Et1/0 172.16.10.2 Et0/0 172.16.1.85 06 0089 0089 1892
Et1/0 172.16.10.2 Et0/0 172.16.1.86 06 0185 0185 1762
Et1/0 172.16.10.2 Et0/0 172.16.1.86 06 00B3 00B3 2
Et1/0 172.16.10.2 Et0/0 172.16.1.84 06 0050 0050 1
Et1/0 172.16.10.2 Et0/0 172.16.1.85 06 0050 0050 1
7 of 10 top talkers shown. 7 flows processed.

Network, user and application monitoring

The most obvious use for NetFlow is network monitoring. NetFlow data provides detailed bandwidth usage information that can be broken down, for example, by user, client system, time, or application. The respective data arrives at the NetFlow collector almost in real time.

As a single computer or service that uses a sufficiently large amount of bandwidth can affect network performance for other users, monitoring traffic patterns, user patterns, and application patterns can alert an administrator to potential issues before they happen. This provides a valuable troubleshooting resource.

Network planning

Capturing NetFlow data over longer periods of time and analyzing trends found within the data provides an opportunity to know in advance what the network requires. Perhaps various applications running at the end of the month generate additional traffic that affects network performance. In that case, other high-bandwidth activities can be scheduled at different times of the month to prevent bottlenecks.

Furthermore, NetFlow data can help determine when traffic growth is actually becoming too high for the current hardware to handle. This offers plenty of time to purchase, install, and configure additional or faster routers and switches.

Usage-based billing and reporting

With its ability to identify specific traffic streams (including where they originated and which applications triggered them), NetFlow data can be analyzed to see how much of the network is used by specific users, groups, or applications. With such detailed data, it is easy to adjust billing rates based on the time of day, application usage, or total bandwidth. 

Security analysis

NetFlow can help with network security as well. If a user suddenly generates large amounts of traffic that they usually not require for their job, perhaps their account has been compromised. NetFlow data quickly reveals anomalies in network traffic, whether it’s a worm trying to spread, malware trying to contact a control server, or a disgruntled employee copying sensitive company data.

While the overall traffic generated by NetFlow is relatively low, it is important to locate the NetFlow collectors strategically to avoid sending data via expensive connections or via connections that can’t handle additional traffic. Local data collection works best for most environments.