- We look at NetFlow version five in our previous video.
And as far as troubleshooting
there really isn't much difference
between version five and version nine.
Version five is probably the most widely used version.
Due to its wide range of compatibility and legacy support.
Older NetFlow collectors can easily handle version five
and NetFlow records.
And that's because the format of version five records
are fixed. So the format never changes.
Version nine adds better security and analysis features.
And the ability to accurately report on multicast traffic,
the format of NetFlow version nine records is dynamic.
And that means the format can change.
For this reason, version nine uses templates
that are periodically sent to the collector
so that the collector is aware of the format
that the data is being exported in,
let's run through some of our show commands.
And those are actually the same for this version,
as they were for version five,
let's say show IP
flow,
export.
And again,
you want to verify the correct version of NetFlow is in use,
we see that this is using version nine flow records,
so that's good.
We can also see our source,
which is the gigs zero slash one interface IP address
of 10.1.1.1 that's pointing over to our hosts
in the 10.1.1.0/24 network.
And we can see the destination 192.168.10.5,
which is our NetFlow collector server,
and that is using port 5000.
So obviously, you want to check both of these IP addresses.
And you want to check the port assignment
to make sure all of that is correct,
we can see that again, we have Port 5000 configured,
but you would want to configure that
to match whatever your NetFlow collection server is using,
we can see a record of our exported flows here as well,
we have a couple of flows exported recently
in this lab topology.
And below that,
we will be able to see anything that had failed.
Just a couple more things that I'll point out
about this flow export cache,
these flows on the Cisco device are temporary.
If they are not exported to a net flow collector,
they will eventually be removed from the cache
to save space and resources.
So again, that underscores why it's a good idea
and a best practice to use an external collector
to maintain an historical perspective
on your flow collection.
Also note,
that when you have an external NetFlow collector configured,
the captured flows are exported
only after the flows expire in the cache
of the local device, which in this case would be router one.
This happens when the flow has been idle for 15 seconds
by default,
when the max age has been reached of 30 minutes
by default,
or when the TCP connection has been closed or reset
for the flow.
Also, if the local cache fills up completely,
the older entries are going to be aged out
and they'll be exported.
Just to reiterate some more helpful show commands
we can say show IP
flow
interface
to see where we have that configured.
Again, we see the gig zero slash one interface
is configured for collection.
And we see both ingress and egress configured
meaning that we are capturing traffic in both directions,
both arriving on this interface and exiting this interface.
So again, depending on your needs,
you want to make sure the traffic direction
is configured properly with NetFlow.
So that's a look at troubleshooting NetFlow version nine,
in Cisco IOS.