Cisco Systems OL-6900-01 manual Overview, What Are NetFlow Services?, C H A P T E R

C H A P T E R 1

Overview

This chapter describes the CNS NetFlow Collection Engine application, which is used with the NetFlow services data export feature on Cisco routers and Catalyst 5000 and 6000 series switches.

This chapter includes the following sections:

•What Are NetFlow Services?

•What Is CNS NetFlow Collection Engine?

•CNS NetFlow Collection Engine Architectural Overview

What Are NetFlow Services?

NetFlow services consist of high-performance IP switching features that capture a rich set of traffic statistics exported from routers and switches while they perform their switching functions. The exported NetFlow data consists of traffic flows, which are unidirectional sequences of packets between a particular source device and destination device that share the same protocol and transport-layer information. The captured traffic statistics can be used for a wide variety of purposes, such as network analysis and planning, network management, accounting, billing, and data mining.

Because of their unidirectional nature, flows from a client to a server are differentiated from flows from the server to the client. Flows are also differentiated on the basis of protocol. For example, Hypertext Transfer Protocol (HTTP) Web packets from a particular source host to a particular destination host constitute a separate flow from File Transfer Protocol (FTP) file transfer packets between the same pair of hosts.

Routers and switches identify flows by looking for the following fields within IP packets:

•Source IP address

•Destination IP address

•Source port number

•Destination port number

•Protocol type

•Type of service (ToS)

•Input interface

Cisco CNS NetFlow Collection Engine User Guide, Release 5.0.2

OL-6899-01 1-1