Cisco 3850 NetFlow Configuration


1. Create a Flow Record (specify the fields to export)
A flow record defines the information that NetFlow gathers, such as packets in the flow and
the types of counters gathered per flow. You specify a series of “match” and “collect”
commands that tell the router which fields to include in the outgoing NetFlow PDU.
The “match” fields are the “key” fields. They are used to determine the uniqueness of the
flow. The “collect” fields are just extra info that to include to provide more detail to the
collector for reporting and analysis.
The fields marked with required below, are fields required for StealthWatch to accept and
build a flow record.
sw3850(config)# flow record LANCOPE1
sw3850(config-flow-record)# description NetFlow record format to send to StealthWatch
sw3850(config-flow-record)# match datalink mac source address input
sw3850(config-flow-record)# match datalink mac destination address input
sw3850(config-flow-record)# match datalink vlan input key field
sw3850(config-flow-record)# match ipv4 ttl key field; provides pathing info
sw3850(config-flow-record)# match ipv4 tos required; key field
sw3850(config-flow-record)# match ipv4 protocol required; key field
sw3850(config-flow-record)# match ipv4 source address required; key field
sw3850(config-flow-record)# match ipv4 destination address required; key field
sw3850(config-flow-record)# match transport source-port required; key field
sw3850(config-flow-record)# match transport destination-port required; key field
sw3850(config-flow-record)# match interface input required; key field
sw3850(config-flow-record)# collect interface output required; used for computing bps rates
sw3850(config-flow-record)# collect counter bytes long required; used for bps calculation
sw3850(config-flow-record)# collect counter packets long required; used for pps calculation
sw3850(config-flow-record)# collect timestamp absolute first required; for calculating duration
sw3850(config-flow-record)# collect timestamp absolute last required; for duration