There are a lot of great reasons why
we might want to know what's going on on a network.
They can include capacity planning,
or implementing a new service that we want to make sure
we have the bandwidth for or the quality of service
for, or perhaps, security.
We're curious about certain protocols
that are banned or shouldn't be on our network.
Are they there?
Those are all great reasons for running NetFlow
to find out what's going on.
So there are three basic steps of getting NetFlow
up and working, assuming we have gear that supports it.
Number one, we need to train devices to do it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Number one, we need to train devices to do it.
So let's imagine here on R1 that we want to use NetFlow.
And we would go to the routers, a couple ways of doing this.
We'll talk about both.
We'd go to the router, though, effectively,
and say, "Dear Mr. Router, on this interface, gig 1/0,
we want you to pay attention to traffic that's going out,
the routing of that interface.
And also that you're receiving on that interface
and keeping track of those flows of traffic."
So we're not asking it to capture the traffic
and save the packets.
We're just asking it to remember what it was, like, oh,
that was TCP.
It was from here to there, and so forth, things WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It was from here to there, and so forth, things
like that, each flow of traffic.
So if we had a client, like, this PC here,
who is accessing a server over here--
I'll draw one; there you go--
and we are using NetFlow here, that one flow of traffic
would be recorded by the router from the ports involved,
or based on what we were looking for for that flow.
And then when the server responded back,
if we were analyzing traffic inbound as well,
we'd have two flows of data.
Now you multiply that by thousands and thousands WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now you multiply that by thousands and thousands
of different flows, and the router has a lot of information
it's collecting.
So, what we're going to do is collect the data first.
That's the first task.
And then the second thing is we are going to ship it off
to a storage point.
So that is going to be our storage for all these records.
So that storage point is referred to as a collector.
Think of a collector, like, some people collect stamps.
Some people collect model planes.
This collector is collecting the flow records
from network devices for NetFlow.
And so what we would do is we would WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so what we would do is we would
train R1 that, hey, go ahead and cache that information
about those flows that are happening.
There could be thousands of them.
Cache it for a short period of time.
And then periodically, go ahead and send that information
down to your collector, or to a collector.
And that is referred to as an export.
So if we are exporting our flow records to a collector,
that's how we get them from the device who
saw the traffic, down to the collector
who can capture the traffic.
And once that data is stored there, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And once that data is stored there,
we can then go ahead and use tools to analyze traffic Now
that analyzing tool may be on the same server,
or maybe a different server that's
just digging into the data.
And then it can build all the cool graphs for us,
the graphs saying, hey, your majority of traffic
is this type of protocol.
Or the majority of the top talkers
were these devices on the network--
and anything you'd like to know about flows
going through this device.
If he saw them, he's collecting that information,
not collecting the packets, just a Reader's Digest overview of, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
not collecting the packets, just a Reader's Digest overview of,
hey, here's what happened.
I don't have the packets anymore.
But I just remember what happened
and I sent them over here.
So that's the concept of NetFlow,
to collect the information regarding
the flows the traffic, to export them over to a collector,
and then analyze them or use that data
in some meaningful way-- for security
or for capacity planning, or just
to have a better understanding of what's really
happening on the network.
So that's the big picture with NetFlow.
And in the next video, what I'd like to do
is chat with you about some evolution of NetFlow,
including the two major versions, and then WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
including the two major versions, and then
a little tweak for version 10 as well.
So we'll take care of that in the next video.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.