Clarification on NTA Flow Records Compulsory Fields

ImNishat

Hi Team,

I am reaching out to cross-verify and seek clarity on the NTA Flow Records compulsory fields mentioned below. Are timestamp fields also required when configuring flow records on a device? Could you please provide an example to illustrate where I can find this timestamp field?

In the screenshot below (taken from the SolarWinds Portal), only five fields are highlighted. What exactly are they trying to convey with the statement: "At least one should have a valid inputint or outputint value"? Could you explain what this means?

Secondly, could you clarify if the fields mentioned below are common across all devices where flow records are configured, or if they vary depending on the device type and brand?

1. Protocol. 
2. Source IP.
3. Destination IP.
4. Input / Output Interfaces. Minimum Anyone or can be both.
5. At least one bytes group.  What is the meaning for this, and how can i configure this?
6. Source Port.
7. Destination Port.

• Timestamps for accurate tracking of flow start and end.  Is it also compulsory or good to have it?

Looking forward to your response.

Thank you!

marcrobinson

Hello @ImNishat  - You might want to take a look at the requirements for Netflow 5 version - this is one of the two formats supported by NTA. NetFlow version 9 is also supported but it must include the fixed fields of version 5. The NTA pages link to several Cisco docs. I found a downloadable guide on Cisco that includes good detail on flow, along with snmp and logs. SNMP_NetFlow_Syslog.pdf (learningnetwork.cisco.com/.../snmp-netflow-syslog-pdf) This is one of the better and simpler explanations that I have read. Another nice list of flow versions from IBM - NetFlow versions - IBM Documentation  www.ibm.com/.../1.3.1

The main point is that the device must support Netflow version 5 or 9*. 

* - As a NetFlow collector, NTA can receive exported NetFlow version 5 data and NetFlow version 9 data that includes all fields of the NetFlow version 5 template. Once it collects NetFlow traffic data, NTA analyzes device bandwidth usage in terms of the source and destination endpoints of conversations reflected in the traffic. Set up network devices to export NetFlow data

documentation.solarwinds.com/.../nta-setting-up-network-devices-to-export-netflow-data-manually-sw75.htm

Configuring Netflow will vary on a per device and even per operating system basis. You will find similarities across models. The solarwinds link above includes links to cisco models and several other vendors. Note that not all network device manufacturers support netflow equally or that solarwinds can ingest them, particularly if they do not meet the netflow version 5 template. 

Yes you need to have the required fields or the data will be rejected. You will most likely see an error in the flow logs in the SolarWinds webconsole saying something like malformed or incorrectly formatted flow data was received from IP address # and will be rejected. Please format it properly. 

I believe that the inputint and outputint are referring to the input or ingress interface index number and the output or egress interface index number.  If the interface does not have a 'name' they will often show up as the index number in the flow webconsole. 

The time stamps are required and critical as they document when the network conversation occurred. 

Hope this helps,

Marc