Cisco Systems C3850NM410G - page 25

© 2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 25 of 70
Configuring a Flow Record (Egress)
flow record v4out
match ipv4 protocol
match ipv4 tos
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface output
collect interface input
collect transport tcp flags
collect counter bytes long
collect counter packets long
collect timestamp absolute first
collect timestamp absolute last
collect counter bytes layer2 long
Exporter/Collector Information
There are two primary methods to access NetFlow data: using a CLI with show commands or using an application
that receives exported NetFlow information sent periodically by the switch.
flow exporter Collector
destination 10.1.1.28
dscp 48
transport udp 2055
template data timeout 30
option exporter-stats timeout 30
Flow exporter commands specify the destination IP address of the exporter/collector. DSCP specifies the DSCP
value for datagrams sent to the exporter/collector. The next command specifies the L4 port on which the
exporter/collector application listens for the NetFlow export packets from the switch. Template commands enable
the switch to send the NetFlow template after specified number of seconds to the exporter/collector. The Cisco
Catalyst 3850 supports up to eight different exporters/collectors simultaneously per flow monitor.
Flow Monitor
Flow monitors are the FnF component that is applied to interfaces. Flow monitors consist of a record, cache
parameters, and the exporter/collector. The flow monitor cache is automatically created at the time the flow monitor
is configured on the first interface.
Flow monitor is the container for the following information:
● Flow record
● Flow cache parameters
● Exporter/collector information