Template-based NetFlow

Recently we added support for NetFlow Version 9 to the Orion NetFlow Traffic Analyzer. Since then, I've helped several customers configure their devices to correctly send NetfFlow v9 data and based upon some of the questions I'm seeing in our forums and elsewhere I figure'd it would be a good topic to write about tonight.

The single most distinguising factor of Netflow v9 (which later became the basis for the IETF standard and for IPFix) is that it is template-based. In NetFlow v5, you have a fixed set of fields and the format and order of these fields are known by both the sender (the router) and receiver (Orion NPM for instance) and are fixed. With NetFlow v9 (and IPFix), the sender sends periodically sends a template that tells the receiver how to interpret the data that's being included in the NetFlow packets. There are several advantages to this technology - one of which is it allows both the hardware vendors supporting NetFlow and the software vendors (like us) receiving and displaying NetFlow data to support new technologies very quickly.

For now, the number one thing to remember is that when you're configuring the network device (router, switch, firewall, WAN optimizer, etc) to export NetFlow v9 packets you MUST specify the template that will be used for the packets. This is an additional command from what you may be used to when configuring for NetFlow v5 or SFlow.

Flame on...
Josh