- [Instructor] Flexible NetFlow
provides enhanced optimization
of the network infrastructure.
It reduces cost and improves capacity planning
and security detection beyond other flow-based technologies
available today.
Flexible NetFlow supports IPv6
and network-based application recognition or NBAR2
for IPv6, starting in Cisco IOS software
version 15.2.
It also supports IPv6 transition technologies.
Flexible NetFlow can detect
the following tunneling technologies
that give full IPv6 connectivity
for IPv6 capable hosts
that are on the IPv4 internet
but have no direct native connection to the IPv6 network.
It supports Teredo,
Intra-Site Automatic Tunnel Addressing Protocol, ISATAP,
6to4, 6RD.
Flexible NetFlow
tracks different applications simultaneously.
For instance, security and monitoring, traffic analysis
and billing can be tracked separately
and the information customized per application.
Flexible NetFlow allows the network administrator
or security professional to create multiple flow caches
or information databases to track.
Conventionally, NetFlow has a single cache
and all applications use the same cache information.
With Flexible NetFlow,
it supports the collection of specific security information
in one flow cache and traffic analysis in another.
Subsequently, each NetFlow cache serves a different purpose.
For instance, multi-cast and security information
can be tracked separately
and the results sent to two different collectors.
The figure here shows the Flexible NetFlow model
and how three different monitors are used.
Monitor one exports Flexible NetFlow data
to exporter one.
Monitor two exports Flexible NetFlow data
to exporter two, and monitor three
exports Flexible NetFlow data to exporter one
and exporter three.
The following are the Flexible NetFlow components:
records, flow monitors,
flow exporters and flow samplers.
In Flexible NetFlow,
the administrator can specify what to track
resulting in fewer flows.
This helps to scale in busy networks and use fewer resources
that are already taxed by other features and services.
Records are a combination of key and non-key fields.
In Flexible NetFlow, records are appointed to flow monitors
to define the cache that is used for store flowing data.
Records are a combination of key and non-key fields.
And in Flexible NetFlow,
records are appointed to flow monitors to define the cache
that is used for storing flow data.
There are seven default attributes in the IP packet identity
or key fields.
For a flow and for a device to determine
whether the packet information is unique
or similar to other packets sent over the network,
fields such as TCP flags, subnet masks, packets
and number of bytes are non-key fields.
However, they are often collected
and exported in NetFlow or IPFIX.
There are several Flexible NetFlow key fields
in each packet that is forwarded
within a NetFlow enabled device.
The device looks for a set of IP packet attributes
for the flow and determines whether the packet information
is unique or similar to other packets.
And in Flexible NetFlow,
key fields are configurable,
which enables the administrator
to conduct a more granular traffic analysis.