Consolidated Platform Configuration Guide, Cisco Ios Release 15.2(4)E (Catalyst 2960-X Switches - Cisco Catalyst 2960 series Configuration Manual

How to Configure NetFlow Lite
Configuring Layer 2 NetFlow
You can define Layer 2 keys in NetFlow Lite records that you can use to capture flows in Layer 2 interfaces.
SUMMARY STEPS
1. configure terminal
2. flow record name
3. match datalink { ethertype | mac { destination { address input } | source { address input } } }
4. match { ipv4 {destination | protocol | source | tos } | ipv6 {destination | flow-label| protocol| source|
traffic-class } | transport {destination-port | source-port} }
5. end
6. show flow record [name ]
7. copy running-config startup-config
DETAILED STEPS
Command or Action
Step 1 configure terminal
Example:
Switch# configure terminal
Step 2
flow record name
Example:
Switch(config)# flow record L2_record
Switch(config-flow-record)#
Step 3 match datalink { ethertype | mac { destination { address
input } | source { address input } } }
Example:
Switch(config-flow-record)# match datalink mac source
address input
Switch(config-flow-record)# match datalink mac
destination address input
Step 4 match { ipv4 {destination | protocol | source | tos } | ipv6
{destination | flow-label| protocol| source| traffic-class } |
transport {destination-port | source-port} }

Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)

532
Purpose
Enters the global configuration mode.
Enters flow record configuration mode.
Specifies the Layer 2 attribute as a key. In this
example, the keys are the source and destination MAC
addresses from the packet at input.
When a datalink flow monitor is assigned to
Note
an interface or VLAN record, it only creates
flows for non-IPv4 or non-IPv6 traffic.
Specifies additional Layer 2 attributes as a key. In this
example, the keys are IPv4 protocol and ToS.