Cisco WS-SUP32-GE-3B - Supervisor Engine 32 Software Configuration Manual page 771

Chapter 47 Configuring NetFlow
These sections describe NetFlow on the PFC3B in more detail:
•
•
Flow Masks
A flow is a unidirectional stream of packets between a given source and a given destination. A flow mask
specifies the fields in the incoming packet that NetFlow uses to identify the flow. NetFlow gathers
statistics for each flow defined by the flow mask.
The PFC3B supports the following flow masks:
•
•
•
•
•
•
The flow mask determines the granularity of the statistics gathered, which controls the size of the
NetFlow table. The less-specific flow masks result in fewer entries in the NetFlow table and the
most-specific flow masks result in the most NetFlow entries.
For example, if the flow mask is set to source-only, the NetFlow table contains only one entry per source
IP address. The statistics for all flows from a given source are accumulated in the one entry. However, if
the flow mask is configured as full, the NetFlow table contains one entry per full flow. Many entries may
exist per source IP address, so the NetFlow table can become very large. See the
Guidelines and Restrictions" section on page 47-5
OL-11439-03
Flow Masks, page 47-3
Flow Mask Conflicts, page 47-4
source-only—A less-specific flow mask. The PFC3B maintains one entry for each source IP
address. Statistics for all flows from a given source IP address aggregate into this entry.
destination—A less-specific flow mask. The PFC3B maintains one entry for each destination IP
address. Statistics for all flows to a given destination IP address aggregate into this entry.
destination-source—A more-specific flow mask. The PFC3B maintains one entry for each source
and destination IP address pair. Statistics for all flows between the same source IP address and
destination IP address aggregate into this entry.
destination-source-interface—A more-specific flow mask. Adds the source VLAN SNMP ifIndex to
the information in the destination-source flow mask.
full—A more-specific flow mask. The PFC3B creates and maintains a separate table entry for each
IP flow. A full entry includes the source IP address, destination IP address, protocol, and protocol
ports.
full-interface—The most-specific flow mask. Adds the source VLAN SNMP ifIndex to the
information in the full-flow mask.
Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY
for information about NetFlow table capacity.
Understanding NetFlow
"NetFlow Configuration
47-3