cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
5084
Views
0
Helpful
4
Replies

Netflow report with ifName?

choywy
Level 1
Level 1

Hi,

Need some help on Netflow reporting...

I am using Cisco Netflow Collector version 6.0 and it is collecting Netflow data correctly.

Question is which report (aggregation schemes) will give me flow data with the router's interface name? I tried using the "key builders" in the collector but fail....

Any suggestion will be really appreciated....

Thanks..

4 Replies 4

Giuseppe Larosa
Hall of Fame
Hall of Fame

Hello Chowvy,

as far as I know all netflow export packets contain the SNMP ifindex of the interface and not the name.

you can easily check the corrispondence of SNMP ifindex and interface name using the following command

show snmp mib ifmib ifindex

you can take the output of the show in a text file and you can write a script that puts the interface name in place of SNMP ifindex.

it is also recommended to configure snmp if-index persist so that SNMP ifindexes are kept the same across device reloads ( note this is not guaranteed in case of IOS upgrade when moving between trains / feature sets)

Hope to help

Giuseppe

Hi guislar,

thanks for your info....Hmm..Is it possible resolve the ifindex via the collector to the ifName and presented in the flow reports?

We've hunderds of devices hence it is a major task for us to write a script and match ifindex to ifName on those devices. Not to mention when there is a IOS upgrade and we have to re-write the mapping again..

Can we ask the collector to snmp poll the devices and resolve it and present it in the flow report?

Thanks..

Hello Chowvy,

you can have an SNMP query performed on the same server where NFC is running.

However, if you are using Cisco netflow collector  there is a text configuration file that provides the mapping:

nfcifname.xml

/opt/CSCOnfc/config

SNMP interface name mapping configuration file

see

http://www.cisco.com/en/US/docs/net_mgmt/netflow_collection_engine/6.0/tier_one/installation/guide/config.html#wp1057224

you may have a script that executes appropriate SNMP queries on network devices and then populates the above configuration file.

>> NetFlow Collector caches the SNMP query results in memory. You can...changes are made in the nfcifname.xml file, you must restart NetFlow Collector for these changes...

see

www.cisco.com/en/US/docs/net_mgmt/netflow_collection_engine/6.0/tier_one/user/guide/T1User.pdf

Hope to help

Giuseppe

jakewilson
Level 1
Level 1

Exporting interface names in NetFlow was introduced in IOS 12.4(2)T or 12.4(4)T depending on what Cisco documentation you reference and is supported in NetFlow v9.

Router(config)# ip flow-export interface-names

Interface Names via NetFlow v9 look like this:

The above can also be used with NetFlow NBAR:
Router(config)# ip flow-export template options nbar

Scrutinizer v8 (currently in beta) leverages the above so that administrators have no dependency on SNMP.  You can read more about this by searching the plixer blog.

I hope this helps.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco