So here's our topology that we're working with here.
Let me get rid of this pop-up right there.
All right, so here is our topology that we're working with.
And what we're gonna do is we're gonna talk about
what NetFlow does.
First of all, we need to know what is a flow.
Actually, we're not gonna use yellow on white.
We're gonna use something darker here.
What is a flow?
A flow is anytime you really have some sort of traffic
that is flowing between two devices. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
that is flowing between two devices.
Like right down here we have,
I think this is router seven,
and down here we have router eight on the screen.
When these two start some sort of session
and there is a flow of traffic
going back and forth between them,
you're gonna see a lot of things that they have in common.
Source IP, destination IP,
and of course the return traffic has those flipped.
Source port, destination port,
and lots of time you see something similar, WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
and lots of time you see something similar,
but maybe a little bit flipped on the return traffic there.
And we can use these types of things to see like,
okay, well, it's sourced from here, destined to here,
and then we see the return traffic coming back,
and they have a lot going on.
Using this type of four or five item tuple
that we have here,
we can kind of identify when traffic starts flowing
between these devices.
Now lots of times we have a router WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
Now lots of times we have a router
kind of in the middle of these.
And one of the things that we get the opportunity to do
is when you have core routers
that sit in the center of your network
and traffic flows between them,
all of a sudden one of the things that we want to do
is analyze the flows.
Who is our biggest talker?
What types of traffic are they sending back and forth?
Is there any protocol WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
Is there any protocol
that we have prohibited on our network
that is actually traversing our network?
Those are the kinds of things
that we can start to analyze by collecting flows.
Now NetFlow was created by Cisco,
and Cisco ultimately has gone through three iterations.
Version one, which didn't really get a lot of adoption.
Version five, which got a lot more adoption,
but still was limited in the kinds of data
that it could collect.
And now where we are today with NetFlow is version nine. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
And now where we are today with NetFlow is version nine.
You are here, and even between the Anarsi exam.
The Anarsi version one exam
tested you on version five and version nine.
Now in version 1.1,
they've gotten rid of version five
and done version nine plus something called IP fix,
which is really version 10,
and it is the open standard version.
So what do these do? WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
So what do these do?
Well, version five collected,
version one collected basically no data,
nothing really that was really interesting.
Version five collected more data.
Version nine collects even more data than that.
And also introduces a framework called flexible NetFlow,
which we're gonna talk a lot more about.
And then version 10 collects even more data
and is also open standard
so that multiple vendors can use it.
When we talk about the versions, WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
When we talk about the versions,
we're really talking about the export format,
how the data is sent.
So when we set up NetFlow,
we say we wanna start collecting data
that goes in or out of this particular interface.
We wanna identify all flows
that go in or out of this interface.
And then we set up an exporter
or some type of export job that exports that data
that is held in cache temporarily
to basically a database, WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
to basically a database,
but the correct term here is the collector.
Then from the collector,
you get the ability to build a website
that has pretty charts
and allows you to analyze the data using dashboards.
That's ultimately the goal with NetFlow.
Now, this can also be integrated with security platforms.
Now, obviously it's a really important thing to do.
You see these with things like Cisco Catalyst Center WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
You see these with things like Cisco Catalyst Center
and the Assurance Platform,
although that's mostly streaming telemetry,
but that's kind of the idea.
We set up what we want to capture, ingress or egress.
We set up an exporter,
which says send the data down here to this collector.
And then the collector builds dashboards on top of it.
So when we talk about version nine or IP fix,
which is really version 10,
we're talking about the format of data
that gets exported to the collector. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
that gets exported to the collector.
The collector needs to be able to receive version nine
or IP fix, but for the most part, it usually is.
So that's kind of the gist with NetFlow.
It's really about capturing flows,
usually at the center of your network
so that you could see what's going on
across the whole network.
But if you suspected something is going on
with this router right here,
you could run a NetFlow setup right there.
So in the next video,
what we'll do is we'll look at a very basic WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
what we'll do is we'll look at a very basic
version nine IP flow configuration.
I'll caveat this right now and say,
it's not the primary type of configuration
we use really today.
We all prefer to use flexible NetFlow
and we'll spend a lot more time talking about that
in the video that comes after that.