May 7 / Greg

Cacti Video Tutorial Netflow / Flowviewer

I wasn’t initially clear enough, so here is meat and potatoes explanation of netflow, then it will get into the history:

Imagine a user in your network is downloading a huge file from somewhere on the internet. Now imagine you are exporting netflow information from your internet router and collecting it on your cacti box. You will be able to run a query and see that Bob is using a lot of bandwidth. You then run a query looking for just Bob’s traffic. You will see that Bob was pulling X amount of data from a specific server whose IP address is X.X.X.X. You will be able to tell that Bob was using FTP to pull the files because the source port from X.X.X.X was port 20.

Where did netflow come from? Back in the long long ago, in the before time, Cisco used fast switching. As traffic would enter a router, it would do a lookup in the processor to see which direction to send the traffic. This would create a “flow”. All subsequent traffic associated with this flow would simply be switched through at high speed. “Route once, switch many.” This was eventually depreciated for more efficient techniques, namely CEF.

Cisco Express Forwarding takes the route table and compiles it into a special set of tables, the adjacency and FIB (forward information base). These tables sit in ASICs (application specific integrated circuits). Since these guys sit in hardware and don’t require the processor to get involved, everything moves faster. Sooooo, getting back to the point of this article 😉

Netflow is now used to monitor traffic moving through a network. When netflow is enabled on a router, it will export the following information per flow:

Source IP
Destination IP
Source Port
Destination Port
Amount of Information Sent

On our Cisco routers, when you enable netflow on an interface, it only takes effect in an incoming direction. What this means is that you really need to enable it on any interface that passes traffic. You then configure the router to export this information to your collector; in this case, our cacti box.

To see configurations click the link below for full article!!!

Configuring your router to export neflow:
You need to enter the following commands per interface that passes traffic:

!this takes you into interface configuration mode
router(config)#interface FastEthernet 0/1
!this is what actually starts the collection of information
router(config-if)#ip route-cache flow
!Newer versions of IOS may require the following instead
!You can now choose which direction per interface you want to
!collect.
router(config-if)#ip flow {ingress | egress}

Then, you need to tell your router to export the information:

!this is the IP address of our cacti server & port number to dump to
!the port number should be different for every router you are dumping from
router(config)#ip flow-export destination 192.168.9.101 2055
!this is not necessary, but suggested.
!it sets the source IP address that the netflow info will come from
router(config)#ip flow-export source Loopback 0
router(config)#ip flow-export version 5
!This will timeout active flows every 5 mins.  This makes sure
!you are exporting at a regular rate
router(config)#ip flow-cache timeout active 5
!This is the timeout in seconds that it takes a flow to be 
!considered inactive
router(config)#ip flow-cache timeout inactive 15

Cisco’s documentation on Netflow.

Configure your cacti box to collect:

*****You need to make sure you have a firewall allowance for the UDP port that your routers will be dumping netflow from.*****

You then need to configure your export host in cacti. If you are only dumping from a single router, and you are dumping to port 2055, then you are golden. The default host is already configured for it. All you have to do is start the netflow service.

Starting the netflow service.
All you have to do, if you are using cactiEZ is to issue the service start command.

1	service flow-capture start

You will also want the service to start when the machine reboots:

1	chkconfig --level 3 flow-capture on

You should now be able to start running queries on your netflow info. If you don’t seem to be getting any info, check first to see if you are receiving netflow. Lets use tcpdump:

1	tcpdump udp port 2055

You should see a large amount of packets hitting your server. If you don’t check your iptables firewall and make sure you have an allowance. If you have the allowance there, then check your router by issuing the following:

1 2	show ip flow export show ip cache flow

You can always just watch the video, though hehe :

Cacti Video Tutorial Netflow / Flowviewer

31 Comments

Leave a Comment

Donate

Blogroll

Contact Me

Contributors

Links

Categories

Pages

Archives

Search