|
|
September 1997
This release note describes the features and caveats for the NetFlow FlowCollector application Release 1.0.
NetFlow FlowCollector Introduction 2
Product Features 2
Product Packaging 2
Product Documentation 2
Related Publications 3
Platform Support 3
Workstation Requirements 3
NetFlow Data Export Versions 3
Installing the FlowCollector 4
Running the FlowCollector 9
Release 1.0 Caveats 10
Cisco Connection Online 11
Documentation CD-ROM 12
This NetFlow FlowCollector application, FlowCollector, is used with the NetFlow switching data export feature on Cisco 7000 series routers. NetFlow switching is supported in Cisco Internetwork Operating System (Cisco IOS) Release 11.1(2) or later. The recommended version is 11.1(11) CA on the Cisco 7000 family of routers that have a Route/Switch Processor (RSP). There are two versions of data exported from the routers, versions 1 and 5. The FlowCollector supports both versions.
The FlowCollector application provides fast, scalable, and economical data collection from multiple routers exporting NetFlow data records.
The FlowCollector performs the following functions:
The exported NetFlow data consists of expired traffic flows that contain detailed traffic statistics. These traffic flows provide detailed information about network layer sources and destinations, down to the level of individual applications and protocols, constituting the end-to-end conversation. This information helps network managers perform traffic monitoring and fine-tune networks by determining which users and applications need more bandwidth or a specified quality of service. This consolidated information can be used for advanced billing on a per-application and actual usage basis. A network management application can use this data to offer solutions for performance management, traffic management, accounting, and billing tasks.
The NetFlow FlowCollector product suite includes the following files:
The NetFlow FlowCollector Installation and User Guide provides task-based information for installing and using the NetFlow FlowCollector application. The manual is available in hard copy and on the Documentation CD-ROM.
You can access Cisco technical documentation on the Web at http://www.cisco.com. For more information, refer to the "Cisco Connection Online" section later in this document.
For additional information about using the NetFlow FlowCollector application to display traffic statistics on a workstation, refer to the NetFlow FlowAnalyzer Installation and User Guide.
For documentation about available Cisco IOS features, refer to the Cisco IOS, Release 11.1(2) or later, configuration guides, and command references, which are located in the Cisco IOS Release 11.1(2) database.
For more information about electronic documentation, refer to the "Documentation CD-ROM" section later in this document.
The FlowCollector is available for the following platforms:
The NetFlow FlowCollector requires approximately 750 KB of disk space for its binary, configuration, and log files. The amount of disk space required depends on how you configure the application to run on your workstation. You control how much and what type of data to collect. The memory requirement varies with the flow arrival rate and collection interval and with the number of aggregation schemes specified.
The NetFlow FlowCollector application generates output data files of aggregated data. These files require additional disk space, the exact amount depending on the number of aggregation schemes selected and the maximum disk space allowed for each.
The NetFlow FlowCollector Version 1.0 accepts NetFlow exported data Version 1 and Version 5 from a router. Version 5 is a superset of data available in Version 1. The important new fields in Version 5 are
Version 5 of flow export is available in IOS Release 11.1(10.05) CA. The recommended IOS release for NetFlow features is 11.1(11) CA or later.
The FlowCollector application for Solaris and HP-UX platforms is available on CD-ROM. The recommended amount of free disk space is 2 GB.
Use the following installation procedures after installing the FlowCollector software package.
Step 1 Log in as root.
Step 2 After copying the NFC1_0.SOL.tar file from the CD to a locally mounted directory, you must untar the file.
Step 3 Run the installation script and answer all questions.
Answer yes to this last question if you have previously installed a package named CSCOnfc.
The script removes installed packages, verifies package dependencies, processes package information, and removes path names where required.
Select the packages you wish to process (the default is all).
Enter a new location and name for the log file, then press Return to continue.
Enter a location and name for the daemon log file, then press Return to continue.
Step 1 Log in as root.
Step 2 After copying the NFC1_0.SOL.tar file from the CD to a locally mounted directory, you must untar the file.
Step 3 Run the installation script and answer all questions.
Enter a new location and name for the log file, then press Return to continue.
Enter a location and name for the daemon log file, then press Return to continue.
The output of the install session is saved in ./nfc_install.log.
The FlowCollector files must be organized in the directory structure shown in Figure 1.
You must set the following environment variables:
NFC_DIR = /opt/CSCOnfc and NFC_RESOURCEFILE = $NFC_DIR/config/nf.resources
The nf.resources file is located in $/NFC_DIR/config. Unless you have customized changes that must be made during installation, there is no need to change the nf.resources file. Edit your .cshrc or .profile file to set environment variables NFC_DIR and NFC_RESOURCEFILE.
setenv NFC_BIN /opt/CSCOnfc setenv NFC_RESOURCESFILE $NFC_DIR/config/nf.resources
NFC_DIR=/opt/CSCOnfc; export NFC_DIR NFC_RESOURCESFILE=$NFC_DIR/config/nf.resources; export NFC_RESOURCESFILE
The nf.resources file contains the variables and corresponding directory file path names for configuring your environment. The nf.resources file also includes parameters for performance tuning and output file format (see Table 1). You must edit the nf.resources file to specify the path names to the files listed.
| Variable | Default File |
|---|---|
| NFC_CONFIGFILE | nfconfig.file |
| NFC_KNOWNPROTOCOLS | nfknown.protocols |
| NFC_KNOWNSRCPORTS | nfknown.srcports |
| NFC_KNOWNDSTPORTS | nfknown.dstports |
| NFC_LOG | nfc.log |
| NFCD_LOG | nfcd.log |
The following configuration files define the nf.resources variables.
The nfconfig.file (located in $NFC_DIR/config/nfconfig.file) contains definitions of the desired aggregation tasks performed on the data collected. These tasks, defined in terms of threads and filters, tell the FlowCollector how to collect and aggregate the incoming NetFlow export data. Each aggregation task must have a thread defined for it.
If the FlowCollector application does not have write permission to the root directory specified by a DataSetPath attribute, it uses $NFC_DIR as the root directory for the output files of aggregated data. The FlowCollector application supports multiple aggregation tasks simultaneously.
The nfknown.protocols file (located in $NFC_DIR/config/nfknown.protocols) contains protocol definitions for use in the aggregation schemes. These definitions are also used for protocol filters. You edit this file to add/remove protocols. The FlowCollector scans this file and maintains a list of protocols it finds. The FlowCollector searches the defined protocols in the order they are defined in nfknown.protocols. In order to increase performance of the software, put the most often used protocols at the beginning of the file.
The nfknown.srcports file (located in $NFC_DIR/config/nfknown.srcports) contains source port numbers used in the SourcePort aggregation scheme (or other aggregation scheme using source port numbers as part of its key). Traffic from other source ports is considered as Others. You can edit the nfknown.srcports file. The port numbers are specified as individual items or ranges. For example:
1, 24 6000
A range includes boundaries; in the above example 1 and 24 are included.
The nfknown.dstports file (located in $NFC_DIR/config/nfknown.dstports) contains destination port numbers used in the DestPort aggregation scheme (or other aggregation scheme using destination port numbers as part of its key). The file format is the same as that for nfknown.srcports.
To set workstation variables, you must edit the nf.resources file to use the available configuration parameters. Table 2 shows the available parameters, their values, and a description of each.
| Flag | Default Value | Value | Description |
|---|---|---|---|
| OUTPUT_DOTTEDADDRESS | Yes | Yes No | Writes the IP address to the output files in dotted decimal format, for example, A.B.C.D. Writes the IP address to the output files in network address format, for example, 255.255.255.255. |
| LONG_OUTPUTFILE_SUFFIX | No | Yes No | Sets the output file extension to add the year, month, and date to the hour and minute, for example, _YYYY_MM_DD.HHMM suffix. Sets the output file extension to add HH.MM. |
| DEVICE_DOTTEDADDRESS | Yes | Yes No | Uses sender router's IP address for storage. Attempts to get DNS name first |
| GMT_FLAG | Yes | Yes No | Uses the GMT reference. Uses local time. |
| CSV_FORMAT | No | Yes No | Uses CSV in writing aggregation output. Uses a vertical bar ( | ) as the delimeter. |
Due to the high volume of the NetFlow data export traffic, it may be necessary to increase the normal buffer size associated with the UDP socket on which data is received. To do so, edit the value of the SOCKET_BUFSIZE parameter in the $NFC_DIR/config/nf.resources file.
Before you run the FlowCollector, you must set the environment variables. To run the FlowCollector, use the following procedure:
Step 1 Log in as root.
Step 2 Start the FlowCollector application.
To stop the FlowCollector application, enter nfcollector stop all.
The FlowCollector runs as three sets of processes:
1. NFCollector (for collection and aggregation)
2. NFCD (allows the user interface access to the FlowCollector)
3. NFUI (interface for the end user)
The user can use NFUI to talk to a local or remote FlowCollector. By default, NFCD and NFUI are configured to communicate locally. If you plan to access the FlowCollector from a non-local workstation, NFCD must be started to listen on an unused non-reserved UDP port. To do so, you must edit the nfcollector script and replace the line
NFC_BIN/NFCD&
with the following line
NFC_BIN/NFCD <udp port>&
This section lists the caveats for Release 1.0.
Cisco Connection Online (CCO) is Cisco Systems' primary, real-time support channel. Maintenance customers and partners can self-register on CCO to obtain additional information and services.
Available 24 hours a day, 7 days a week, CCO provides a wealth of standard and value-added services to Cisco's customers and business partners. CCO services include product information, product documentation, software updates, release notes, technical tips, the Bug Navigator, configuration notes, brochures, descriptions of service offerings, and download access to public and authorized files.
CCO serves a wide variety of users through two interfaces that are updated and enhanced simultaneously: a character-based version and a multimedia version that resides on the World Wide Web (WWW). The character-based CCO supports Zmodem, Kermit, Xmodem, FTP, and Internet e-mail, and it is excellent for quick access to information over lower bandwidths. The WWW version of CCO provides richly formatted documents with photographs, figures, graphics, and video, as well as hyperlinks to related information.
You can access CCO in the following ways:
For a copy of CCO's Frequently Asked Questions (FAQ), contact cco-help@cisco.com. For additional information, contact cco-team@cisco.com.
Cisco documentation and additional literature are available in a CD-ROM package, which ships with your product. The Documentation CD-ROM, a member of the Cisco Connection Family, is updated monthly. Therefore, it might be more up to date than printed documentation. To order additional copies of the Documentation CD-ROM, contact your local sales representative or call customer service. The CD-ROM package is available as a single package or through an annual subscription. You can also access Cisco documentation on the World Wide Web at http://www.cisco.com, http://www-china.cisco.com, or http://www-europe.cisco.com. 
|
|