Choices can be a double-edged sword.
On the positive side, if we have choices,
like, yeah, lots of great options--
and on the negative side, like, oh, too many options.
So in NetFlow we do have a few options
in implementing and using NetFlow, including versions.
And that's what we're going to discuss in this video.
So let's start at the beginning in the beginning.
In the beginning, NetFlow was created by Cisco.
And they came out with version 1.
But it was short-lived.
It didn't collect a lot of useful information.
And so basically we don't use it anymore.
And they had a few other iterations.
So the two major ones, let's focus on those. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the two major ones, let's focus on those.
The two major ones are version 5 and version 9.
Now, let's talk about those for a moment.
With version 5 and the earlier versions,
basically NetFlow was pretty simple.
It went something like this, "Dear Mr. Router 1,"--
we'll use our NetFlow voice.
"Dear Mr. Router 1, please pay attention
to flows that are going out that interface.
And please pay attention to flows that
are going out that interface."
So you could do it out here and out here,
or you could do it in and out here,
anywhere you want to collect the flow information is great.
And so we tell it that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so we tell it that.
And we'd also specify where the collector was, meaning
this is the server at 8888.
He's a collector.
He's listening on port UDP 6783.
And we would've defined it on the router.
And he would cache his flow or information.
And then ship it out.
Very limited, though, with version 5,
as far as what we could collect.
But there were like some defaults
of what it would look at and flow information that
was sent over to the collector.
Then we'd use our analy--
A-N-A-L-Y-Z-E. We'd use our analyzing tool to look at that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
A-N-A-L-Y-Z-E. We'd use our analyzing tool to look at that
data and make graphs and charts and reports.
That's version 5, pretty much.
Now, what happened was that there
are a lot of additional details that we could have looked
at with NetFlow, including things like IPv6
and details and the IP headers and packets and payloads
that we might want included.
Or maybe we don't want some of that information.
So with version 9, they made it very flexible.
And so sometimes if you see Flexible NetFlow, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so sometimes if you see Flexible NetFlow,
they're referring to version 9 or its cousin version
10, which is modular.
And you might say, Keith, what is modular about NetFlow?
Well, with version 9 if we're using Flexible NetFlow,
we can create an object called a record.
Now, a record, think of it, like, you know how,
like, in NAT, you have an Access Control
List that says what you want to look at
or what you want to permit through the network,
or with QoS use an access list of, say, what
traffic we want to manipulate?
Well, record, think of it like pointing out which WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, record, think of it like pointing out which
parts of the traffic that's flowing through
that you want to look at.
Maybe you want to look at IPv4 traffic,
but just source addresses, or IPv6 traffic, but just
destination address, or whatever it is.
You can create these records that
identify what we want to go ahead and look at.
So we'd create these record objects
and that's why it's modular.
It's like a template of what we want to look for.
And then we could--
I'll walk you through the process here in just a moment--
but we could then apply that as part
of our monitoring process, which leads me to my next piece. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of our monitoring process, which leads me to my next piece.
We create another object called a monitor, M-O-N-I-T-O-R,
monitor?
Yeah, that sounds right.
So what a monitor does is a monitor
is an object that specifies what record we're going to be using,
meaning what do we want to look at.
And we would apply the monitor to an interface.
We could apply a monitor inbound or outbound on gig 1/0,
and then based on that monitor that's applied,
it would know what record to go ahead and apply,
meaning the router would know, here
is the layer 4 information I need WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is the layer 4 information I need
to collect or pay attention to as part of these flows.
Or if it's IPv4, IPv6, and so forth, based on the records.
The other part that's modular is the exporter.
And so the concept of exporting in NetFlow
is where this router takes its cached information
about these flows and ships it off to the collector.
But instead of just defining here
is my destination for exporting, we
can create an exporter object.
And in that exporter object, we can
specify the IP address of the destination server,
the ports involved, our source interface. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the ports involved, our source interface.
And also, when we apply the monitor,
we can include the records.
So if we apply this monitor to gig 1/0 outbound,
that monitor could say we want to pay attention
to these records and that information.
And also, when you get that cached,
we also want you to export it to this destination IP address
defined in the exporter.
So Flexible NetFlow, it's very modular.
So you can create additional records, objects,
and monitor objects and exporter objects,
link them together, apply them. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
link them together, apply them.
The key is the monitor gets applied to the interface
and the monitor is going to point to what the record is,
and also what the exporter is so it knows what to collect
and where to send it.
Ba-da-bing, Flexible NetFlow, version 9.
Now, there is one other option.
And that is that Cisco, when they created NetFlow,
there have been some standardizations
and some RFC's that help standardize the exporting.
And so there's a thing called IP F-I-X. That's the acronym.
And it stands for IP Flow Information Export. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it stands for IP Flow Information Export.
I know export starts with an E, but they wanted
to make the acronym work.
So IPFIX is the standards-based method
for exporting that flow record information out to a collector.
And so in a Cisco environment, when
we're defining the exporter, we can
say we want do exporting using version 9,
or we could use exporter protocol
IPFIX, which they put in parentheses, sometimes, a 10.
And with version 10 with IPFIX, it's referring to the protocol WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And with version 10 with IPFIX, it's referring to the protocol
that we could use between the router and the device that's
receiving all those flows from the router who's caching them.
So now that we know some of the flavors of NetFlow
that we're likely to see in a production environment and use,
in the next video, I'd like to walk you
through a hands-on lab of both implementing and verifying
NetFlow version 5.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.