8.3.3.3 Lab - Collecting and Analyzing NetFlow Data - ILM PDF
8.3.3.3 Lab - Collecting and Analyzing NetFlow Data - ILM PDF
8.3.3.3 Lab - Collecting and Analyzing NetFlow Data - ILM PDF
Instructor Note: Red font color or Gray highlights indicate text that appears in the instructor copy only.
Topology
Addressing Table
Objectives
Part 1: Build the Network and Configure Basic Device Settings
Part 2: Configure NetFlow on a Router
Part 3: Analyze NetFlow Using the CLI
Part 4: Explore NetFlow Collector and Analyzer Software
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 1 of 13
Lab Collecting and Analyzing NetFlow Data
Background / Scenario
NetFlow is a Cisco IOS technology that provides statistics on packets flowing through a Cisco router or
multilayer switch. NetFlow enables network and security monitoring, network planning, traffic analysis, and IP
accounting. It is important not to confuse NetFlows purpose and results with that of packet capture hardware
and software. Packet capturing records all possible information exiting or entering a network device for later
analysis, NetFlow targets specific statistical information.
Flexible NetFlow is the latest NetFlow technology, improving on the original NetFlow by adding the capability
to customize the traffic analysis parameters. Flexible NetFlow uses the Version 9 export format. Starting with
Cisco IOS Release 15.1, many useful Flexible NetFlow commands are supported.
In this lab, you will configure NetFlow to capture both ingress (incoming) and egress (outgoing) packets. You
will use show commands to verify that NetFlow is operational and gathering statistical information. You will
also explore available options for NetFlow collection and analysis software.
Note: The routers used with CCNA hands-on labs are Cisco 1941 Integrated Services Routers (ISRs) with
Cisco IOS Release 15.2(4)M3 (universalk9 image). Other routers and Cisco IOS versions can be used.
Depending on the model and Cisco IOS version, the commands available and output produced might vary
from what is shown in the labs. Refer to the Router Interface Summary Table at the end of this lab for the
correct interface identifiers.
Note: Make sure that the routers have been erased and have no startup configurations. If you are unsure,
contact your instructor.
Instructor Note: Refer to the Instructor Lab Manual for the procedures to initialize and reload devices.
Required Resources
3 Routers (Cisco 1941 with Cisco IOS Release 15.2(4)M3 universal image or comparable)
3 PCs (Windows 7, Vista, or XP with terminal emulation program, such as Tera Term)
Console cables to configure the Cisco IOS devices via the console ports
Ethernet and serial cables as shown in the topology
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 2 of 13
Lab Collecting and Analyzing NetFlow Data
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 3 of 13
Lab Collecting and Analyzing NetFlow Data
ip flow ingress
ip flow egress
Serial0/0/1
ip flow ingress
ip flow egress
b. Issue the show ip flow export command to review the NetFlow data export information.
R2# show ip flow export
Flow export v9 is enabled for main cache
Export source and destination details :
VRF ID : Default
Destination(1) 192.168.2.3 (9996)
Version 9 flow records
388 flows exported in 63 udp datagrams
0 flows failed due to lack of export packet
0 export packets were sent up to process level
0 export packets were dropped due to no fib
0 export packets were dropped due to adjacency issues
0 export packets were dropped due to fragmentation failures
0 export packets were dropped due to encapsulation fixup failures
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.001 .001 .097 .000 .000 .000 .000 .000 .000 .000 .000
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 4 of 13
Lab Collecting and Analyzing NetFlow Data
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 5 of 13
Lab Collecting and Analyzing NetFlow Data
Reflection
1. What is the purpose of NetFlow collector software?
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
NetFlow collector software receives the NetFlow data that is exported from routers and switches on the
network. It filters and aggregates the data according to the policies set up by the network administrator, and
stores this summarized or aggregated data, instead of raw flow data, to minimize disk space consumption.
2. What is the purpose of NetFlow analyzer software?
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
NetFlow analyzer software provides the means to do near real-time visualization and analysis of recorded and
aggregated flow data. It allows you to specify the router, aggregation scheme, and the time interval in which
you wish to view. You can then sort and visualize the data in a manner which makes sense for the users (bar
charts, pie charts, or histograms of the sorted reports).
3. What are the seven critical fields used by the original NetFlow to distinguish flows?
_______________________________________________________________________________________
_______________________________________________________________________________________
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 6 of 13
Lab Collecting and Analyzing NetFlow Data
Source IP address, Destination IP address, Source port number, Destination port number, Layer 3 protocol
type, Type of Service (TOS) marking, Input logical interface.
Router Model Ethernet Interface #1 Ethernet Interface #2 Serial Interface #1 Serial Interface #2
1800 Fast Ethernet 0/0 Fast Ethernet 0/1 Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
(F0/0) (F0/1)
1900 Gigabit Ethernet 0/0 Gigabit Ethernet 0/1 Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
(G0/0) (G0/1)
2801 Fast Ethernet 0/0 Fast Ethernet 0/1 Serial 0/1/0 (S0/1/0) Serial 0/1/1 (S0/1/1)
(F0/0) (F0/1)
2811 Fast Ethernet 0/0 Fast Ethernet 0/1 Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
(F0/0) (F0/1)
2900 Gigabit Ethernet 0/0 Gigabit Ethernet 0/1 Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
(G0/0) (G0/1)
Note: To find out how the router is configured, look at the interfaces to identify the type of router and how many
interfaces the router has. There is no way to effectively list all the combinations of configurations for each router
class. This table includes identifiers for the possible combinations of Ethernet and Serial interfaces in the device.
The table does not include any other type of interface, even though a specific router may contain one. An
example of this might be an ISDN BRI interface. The string in parenthesis is the legal abbreviation that can be
used in Cisco IOS commands to represent the interface.
Router R1
R1# show run
Building configuration...
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 7 of 13
Lab Collecting and Analyzing NetFlow Data
memory-size iomem 15
!
ip cef
!
no ip domain lookup
no ipv6 cef
multilink bundle-name authenticated
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
duplex auto
speed auto
!
interface GigabitEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/0/0
ip address 192.168.12.1 255.255.255.252
clock rate 128000
!
interface Serial0/0/1
no ip address
shutdown
!
router ospf 1
passive-interface GigabitEthernet0/0
network 192.168.1.0 0.0.0.255 area 0
network 192.168.12.0 0.0.0.3 area 0
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
control-plane
!
banner motd ^C Unauthorized Access is Prohibited! ^C
!
line con 0
password 7 030752180500
logging synchronous
login
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 8 of 13
Lab Collecting and Analyzing NetFlow Data
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
password 7 02050D480809
login
transport input all
!
scheduler allocate 20000 1000
!
end
Router R2
R2# show run
Building configuration...
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 9 of 13
Lab Collecting and Analyzing NetFlow Data
interface GigabitEthernet0/0
ip address 192.168.2.1 255.255.255.0
duplex auto
speed auto
!
interface GigabitEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/0/0
ip address 192.168.12.2 255.255.255.252
ip flow ingress
ip flow egress
!
interface Serial0/0/1
ip address 192.168.23.1 255.255.255.252
ip flow ingress
ip flow egress
clock rate 128000
!
router ospf 1
passive-interface GigabitEthernet0/0
network 192.168.2.0 0.0.0.255 area 0
network 192.168.12.0 0.0.0.3 area 0
network 192.168.23.0 0.0.0.3 area 0
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
ip flow-export version 9
ip flow-export destination 192.168.2.3 9996
!
control-plane
!
banner motd ^C Unauthorized Access is Prohibited! ^C
!
line con 0
password 7 14141B180F0B
logging synchronous
login
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 10 of 13
Lab Collecting and Analyzing NetFlow Data
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
password 7 060506324F41
login
transport input all
!
scheduler allocate 20000 1000
!
End
Router R3
R3# show run
Building configuration...
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 11 of 13
Lab Collecting and Analyzing NetFlow Data
!
interface GigabitEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/0/0
no ip address
shutdown
clock rate 2000000
!
interface Serial0/0/1
ip address 192.168.23.2 255.255.255.252
!
router ospf 1
passive-interface GigabitEthernet0/0
network 192.168.3.0 0.0.0.255 area 0
network 192.168.23.0 0.0.0.255 area 0
!
ip forward-protocol nd
!
ip http server
ip http authentication local
no ip http secure-server
!
control-plane
!
banner motd ^C Unauthorized Access is Prohibited! ^C
!
line con 0
exec-timeout 0 0
password 7 01100F175804
logging synchronous
login
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
password 7 0822455D0A16
login
transport input all
!
scheduler allocate 20000 1000
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 12 of 13
Lab Collecting and Analyzing NetFlow Data
!
end
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 13 of 13