Hi All,

The following are instruction on enabling Netflow on Cisco equipments

set the following from the routers global mode.
===============================Begging=======================================

ip cef ----> Cisco Express Forwarding has to be enabled if it was disabled.
ip flow-cache timeout active 60
ip flow-export version 5
ip flow-aggregation cache prefix
export destination x.x.x.x 65535 ----> where x.x.x.x is the destination (ip address) or syslog box or any machine.
enabled ----> This is very important as it enables net-flow.


set the following on each interface on the router which you want to collect network flow data.
===========================================================================

interface fa0/1
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow ---> this enables net flow on per interface basis.

============================End Of File=================================

Simple and straight forward :-).

Cisco and SolarWind have their own non open-source tools to read the logs created by netflow feature.

Does anyone know which tool I can on my Linux to read the logs?

Thanks in Advance

Hi,

NTOP can collect the netflow data and aggregate it into a history view with graphs per protocol, etc.

Just google ntop. I can't post the url due to spam restrictions.

On the features page:
"Act as a NetFlow/sFlow collector for flows generated by routers (e.g. Cisco and Juniper) or switches (e.g. Foundry Networks)"

I believe it handles netflow versions upto v9, although v5 works fine.

You need to enable the collector in the plugins section, as I recall. It becomes available as another interface (instead of eth0, the default).

Ensure that your ntop box has the required netflow ports open or it will receive nothing. You then configure the router to forward the netflow traffic to the IP of the pc running ntop and off you go.

Good luck.
istoff.

I already have NTOP running on my network but, haven't enabled NetFlow features.
Let me work on this and will get back to you guys.

Thanks.