5.4. Configuring Cflowd with CLI

This section provides information to configure Cflowd using the command line interface.

5.5. Cflowd Configuration Overview

The Cflowd implementation supports traffic flow analysis and the use of traffic and access list (ACL) filters to limit the type of traffic analyzed.

5.5.1. Traffic Sampling

Traffic sampling does not examine all packets received by a router. The use can configure command parameters to modify the rate at which traffic is sampled and sent for flow analysis. The default sampling rate is one out of every 1000 packets.

Caution:

Excessive sampling, such as one out of every 100 packets, over an extended period of time can burden router processing resources.

The following data is maintained for each individual flow in the raw flow cache:

  1. source IP address
  2. destinations IP address
  3. source port
  4. destination port
  5. forwarding status
  6. input interface
  7. output interface
  8. IP protocol
  9. TCP flags
  10. first timestamp (of the first packet in the flow)
  11. last timestamp (timestamp of last packet in the flow prior to expiry of the flow)
  12. source AS number for peer and origin (taken from BGP)
  13. destination AS number for peer and origin (taken from BGP)
  14. IP next hop
  15. BGP next hop
  16. ICMP type and code
  17. IP version
  18. source prefix (from routing)
  19. destination prefix (from routing)
  20. MPLS label stack from label 1 to 6

Within the raw flow cache, the following characteristics are used to identify an individual flow:

  1. ingress interface
  2. source IP address
  3. destination IP address
  4. source transport port number
  5. destination transport port number
  6. IP protocol type
  7. IP TOS byte
  8. virtual router id
  9. ICMP type and code
  10. direction
  11. MPLS labels

The user enables Cflowd at the interface level. By enabling Cflowd at the interface level, all IP packets forwarded by the interface are subject to Cflowd analysis.

5.5.2. Collectors 

A collector defines how data flows are exported from the flow cache. The user can configure a maximum of five collectors. Each collector is identified by a unique IP address and UDP port value. Each collector can only export traffic in one version type: Version 5, Version 8, Version 9, or Version 10.

The user can modify the parameters of a collector configuration or retain the defaults.

The autonomous-system-type command defines whether the autonomous system (AS) information is included in the flow data based on the originating AS or external peer AS of the flow.

5.5.2.1. Aggregation

Version 8 allows the aggregation of flow data into larger, less granular flows. Use aggregation commands to specify the type of data to collect. These aggregation types are only applicable to flows that are exported to a Version 8 collector.

The following aggregation schemes are supported:

  1. AS matrix
    Flows are aggregated based on source and destination AS and ingress and egress interfaces.
  2. protocol-port
    Flows are aggregated based on the IP protocol, source port number, and destination port number.
  3. source prefix
    Flows are aggregated based on source prefix and mask, source AS, and ingress interface.
  4. destination prefix
    Flows are aggregated based on destination prefix and mask, destination AS, and egress interface.
  5. source-destination prefix
    Flows are aggregated based on source prefix and mask, destination prefix and mask, source and destination AS, ingress and egress interfaces.
  6. raw
    Flows are not aggregated and are sent to the collector in a Version 5 record.

5.6. Basic Cflowd Configuration

This section provides information to configure Cflowd and examples of common configuration tasks. To sample traffic, the user must configure the following minimal Cflowd parameters.

  1. Cflowd must be enabled.
  2. At least one collector must be configured and enabled.
  3. Sampling must be enabled on the interface (ingress only)

The following is a sample of Cflowd configuration output.

A:Dut-D>config>cflowd$ info detail 
----------------------------------------------
        active-timeout 30
        cache-size 65536
        inactive-timeout 15
        export-mode automatic
        overflow 1
        rate 1000
        template-retransmit 600
        no use-vrtr-if-index
        collector 10.10.10.103:2055 version 9
            description "V9 collector"
            template-set basic
            no shutdown
        exit
        no shutdown 

5.7. Common Configuration Tasks

This section provides an overview of the Cflowd configuration tasks and CLI commands. To begin traffic flow sampling, Cflowd and the user must enable at least one collector.

5.7.1. Global Cflowd Components

The following common (global) attributes apply to all instances of Cflowd:

  1. active timeout
    This attribute controls the maximum time a flow record can be active before it is automatically exported to defined collectors.
  2. inactive timeout
    This attribute controls the minimum time before a flow is declared inactive. If no traffic is sampled for an existing flow for the inactive timeout duration, the flow is declared inactive and marked to be exported to the defined collectors.
  3. cache size
    This attribute defines the maximum size of the flow cache.
  4. overflow
    This attribute defines the percentage of flow records that are exported to all collectors if the flow cache size is exceeded.
  5. rate
    This attribute defines the system wide sampling rate for Cflowd.
  6. template retransmit
    This attribute defines the interval (in seconds) at which the Version 9 and Version 10 templates are retransmitted to all configured Version 9 or Version 10 collectors.

5.7.2. Configuring Cflowd

Use the following CLI syntax to perform Cflowd configuration tasks.

CLI Syntax:
config>cflowd#
active-timeout minutes
cache-size num-entries
inactive-timeout seconds
template-retransmit seconds
overflow percent
rate sample-rate
collector ip-address[:port] {version [5 | 8 | 9 |10]}
aggregation
as-matrix
destination-prefix
protocol-port
raw
source-destination-prefix
source-prefix
template-set {basic | mpls-ip}
autonomous-system-type [origin | peer]
description description-string
no shutdown
no shutdown

5.7.3. Enabling Cflowd

Cflowd is disabled by default. Executing the configure cflowd command enables Cflowd. By default, Cflowd is not shut down but must be configured, including at least one collector, to be active.

Use the following CLI syntax to enable Cflowd.

CLI Syntax:
config# cflowd
no shutdown

The following is a sample configuration output that shows the default values when Cflowd is initially enabled. No collectors or collector options are configured.

A:ALA-1>config# info detail 
...
#------------------------------------------
echo "Cflowd Configuration"
#------------------------------------------
    cflowd
        active-timeout 30
        cache-size 65536
        inactive-timeout 15
        overflow 1
        rate 1000
        template-retransmit 600 
        no shutdown
    exit
#------------------------------------------
A:ALA-1>config#

5.7.4. Configuring Global Cflowd Parameters

This section describes the Cflowd parameters that apply to all instances where Cflowd (traffic sampling) is enabled.

Use the following syntax to configure Cflowd parameters.

CLI Syntax:
config>cflowd#
active-timeout minutes
cache-size num-entries
inactive-timeout seconds
overflow percent
rate sample-rate
template-retransmit seconds
no shutdown

The following is an example of a common Cflowd component configuration:

A:ALA-1>config>cflowd# info 
#------------------------------------------
        active-timeout 20
        inactive-timeout 10
        overflow 10
        rate 100
#------------------------------------------
A:ALA-1>config>cflowd# 

5.7.5. Configuring Cflowd Collectors

Use the following syntax to configure Cflowd collector parameters.

CLI Syntax:
config>cflowd#
collector ip-address[:port] [version version]
aggregation
as-matrix
destination-prefix
protocol-port
raw
source-destination-prefix
source-prefix
autonomous-system-type [origin | peer]
description description-string
no shutdown
template-set {basic | mpls-ip}

The following is a sample configuration output.

A:ALA-1>config>cflowd# info
-----------------------------------------
active-timeout 20
        inactive-timeout 10
        overflow 10
        rate 100
        collector 10.10.10.1:2000 version 8
            aggregation
                as-matrix
                raw
            exit
            description "AS info collector"
        exit
        collector 10.10.10.2:5000 version 8
            aggregation
                protocol-port
                source-destination-prefix
            exit
            autonomous-system-type peer
            description "Neighbor collector"
        exit
-----------------------------------------
A:ALA-1>config>cflowd# 

The following is a sample configuration output for a Version 9 collector.

collector 10.10.10.9:2000 version 9
           description "v9collector"
           template-set mpls-ip
           no shutdown
exit

5.7.5.1. Version 9 and Version 10 Templates

If the collector is configured to use either Version 9 or Version 10 (IPFIX) formats, the flow data is sent to the designated collector using one of the predefined templates. The template used is based on the type of flow for which the data was collected (IPv4, IPv6, or MPLS), and the configuration of the template-set parameter. Table 57 lists traffic flow types and the corresponding template used to export the flow data.

Table 57:  Template-Set 

Traffic type

Basic  

MPLS-IP

IPv4

Basic IPv4

MPLS-IPv4

IPv6

Basic IPv6

MPLS-IPv6

Each flow exported to a collector, configured for either Version 9 or Version 10 formats, is sent using one of the preceding flow template sets. The template is used based on the flow type and how the template-set parameter of the collector is configured.

The following tables list the fields present in each template set listed in Table 57:

  1. Table 58 – Basic IPv4 Template
  2. Table 59 – MPLS-IPv4 Template
  3. Table 60 – Basic IPv6 Template
  4. Table 61 – MPLS-IPv6 Template
Table 58:  Basic IPv4 Template  

Field Name

Field ID

IPv4 Src Addr

8

IPv4 Dest Addr

12

IPv4 Nexthop

15

BGP Nexthop

18

Ingress Interface

10

Egress Interface

14

Packet Count

2

Byte Count

1

Start Time

22

End Time

21

Flow Start Milliseconds 1

152

Flow End Milliseconds1

153

Src Port

7

Dest Port

11

Forwarding Status

89

TCP control Bits (Flags)

6

IPv4 Protocol

4

IPv4 TOS

5

IP version

60

ICMP Type & Code

32

Direction

61

BGP Source ASN

16

BGP Dest ASN

17

Source IPv4 Prefix Length

9

Dest IPv4 Prefix Length

13

    Note:

  1. Only sent to collectors configured for the Version 10 format
Table 59:  MPLS-IPv4 Template  

Field Name

Field ID

IPv4 Src Addr

8

IPv4 Dest Addr

12

IPv4 Nexthop

15

BGP Nexthop

18

Ingress Interface

10

Egress Interface

14

Packet Count

2

Byte Count

1

Start Time

22

End Time

21

Flow Start Milliseconds 1

152

Flow End Milliseconds

153

Src Port

7

Dest Port

11

Forwarding Status

89

TCP control Bits (Flags)

6

IPv4 Protocol

4

IPv4 TOS

5

IP version

60

ICMP Type & Code

32

Direction

61

BGP Source ASN

16

BGP Dest ASN

17

Source IPv4 Prefix Length

9

Dest IPv4 Prefix Length

13

MPLS Top Label Type

46

MPLS Top Label IPv4 Addr

47

MPLS Label 1

70

MPLS Label 2

71

MPLS Label 3

72

MPLS Label 4

73

MPLS Label 5

74

MPLS Label 6

75

    Note:

  1. Only sent to collectors configured for the Version 10 format
Table 60:  Basic IPv6 Template 

Field Name

Field ID

IPv6 Src Addr

27

IPv6 Dest Addr

28

IPv6 Nexthop

62

IPv6 BGP Nexthop

63

IPv4 Nexthop

15

IPv4 BGP Nexthop

18

Ingress Interface

10

Egress Interface

14

Packet Count

2

Byte Count

1

Start Time

22

End Time

21

Flow Start Milliseconds 1

152

Flow End Milliseconds1

153

Src Port

7

Dest Port

11

Forwarding Status

89

TCP control Bits (Flags)

6

Protocol

4

IPv6 Extension Hdr

64

IPv6 Next Header

193

IPv6 Flow Label

31

TOS

5

IP version

60

IPv6 ICMP Type & Code

139

Direction

61

BGP Source ASN

16

BGP Dest ASN

17

IPv6 Src Mask

29

IPv6 Dest Mask

30

    Note:

  1. Only sent to collectors configured for the Version 10 format
Table 61:  MPLS-IPv6 Template 

Field Name

Field ID

IPv6 Src Addr

27

IPv6 Dest Addr

28

IPv6 Nexthop

62

IPv6 BGP Nexthop

63

IPv4 Nexthop

15

IPv4 BGP Nexthop

18

Ingress Interface

10

Egress Interface

14

Packet Count

2

Byte Count

1

Start Time

22

End Time

21

Flow Start Milliseconds 1

152

Flow End Milliseconds1

153

Src Port

7

Dest Port

11

Forwarding Status

89

TCP control Bits (Flags)

6

Protocol

4

IPv6 Extension Hdr

64

IPv6 Next Header

193

IPv6 Flow Label

31

TOS

5

IP version

60

IPv6 ICMP Type & Code

139

Direction

61

BGP Source ASN

16

BGP Dest ASN

17

IPv6 Src Mask

29

IPv6 Dest Mask

30

MPLS_TOP_LABEL_TYPE

46

MPLS_TOP_LABEL_ADDR

47

MPLS Top Label Type

46

MPLS Top Label IPv6 Addr

47

MPLS Label 1

70

MPLS Label 2

71

MPLS Label 3

72

MPLS Label 4

73

MPLS Label 5

74

MPLS Label 6

75

MPLS_TOP_LABEL_TYPE

46

MPLS_TOP_LABEL_ADDR

47

    Note:

  1. Only sent to collectors configured for the Version 10 format

5.7.6. Specifying Cflowd Options on an IP Interface

When Cflowd is enabled on an interface, all packets forwarded by the interface are subject to analysis according to the global Cflowd configuration and sorted according to the collector configurations.

See Table 62 for configuration combinations.

When the cflowd interface option is configured in the config>router>interface context, the following requirements must be met to enable traffic sampling on the specific interface.

  1. Cflowd must be enabled.
  2. At least one Cflowd collector must be configured and enabled.
  3. The interface>cflowd interface option must be selected. For configuration information, see Filter Policy Configuration Overview.

5.7.6.1. Interface Configurations

Use the following CLI syntax to enable traffic sampling on an interface.

CLI Syntax:
config>router>if>cflowd-paramters#
sampling {unicast|multicast} type {interface} [direction {ingress-only}]
no sampling {unicast|multicast}

When the interface option is configured, Cflowd extracts traffic flow samples from an interface for analysis. All packets forwarded by the interface are analyzed in accordance with the Cflowd configuration.

Configure the interface option to enable traffic sampling on an interface. If cflowd is not enabled (no cflowd), traffic sampling does not occur on the interface.

5.7.6.2. Service Interfaces

Use the following CLI syntax to enable traffic sample on a service interface.

CLI Syntax:
config>service>ies>if>cflowd-parameters# sampling {unicast|multicast} type {interface} [direction {ingress-only}]
config>service>vprn>if>cflowd-parameters# sampling {unicast|multicast} type {interface} [direction {ingress-only}]
no sampling {unicast|multicast}

When enabled on a service interface, Cflowd collects routed traffic flow samples through a router for analysis. Cflowd is supported on IES and VPRN service interfaces only. Layer 2 traffic is excluded. All packets forwarded by the interface are analyzed according to the cflowd configuration. On the interface level, Cflowd can be associated with an IP interface.

5.7.7. Dependencies

For Cflowd to be operational, the following requirements must be met.

  1. Cflowd must be enabled on a global level. If Cflowd is disabled, any traffic sampling instances are also disabled.
  2. At least one collector must be configured and enabled for traffic sampling to occur on an enabled entity.
  3. If a specific collector UDP port is not identified, flows are sent to port 2055 by default.

Table 62 displays the expected results when specific features are enabled and disabled.

Table 62:  Cflowd Configuration Dependencies 

Interface Setting

router>interface cflowd [interface] Setting

Command ip-filter entry Setting

Expected Results

Interface mode 1

Interface

none

All IP traffic ingressing the interface is subject to sampling

    Note:

  1. See Configuration Notes for more information.

5.8. Cflowd Configuration Management Tasks

This section describes Cflowd configuration management tasks.

5.8.1. Modifying Global Cflowd Components

Cflowd parameter modifications apply to all instances where cflowd or traffic sampling is enabled. Changes are applied immediately. Use the following syntax to modify global cflowd parameters.

CLI Syntax:
config>cflowd#
active-timeout minutes
no active-timeout
cache-size num-entries
no cache-size
inactive-timeout seconds
no inactive-timeout
overflow percent
no overflow
rate sample-rate
no rate
[no] shutdown
template-retransmit seconds
no template-retransmit

The following example shows the Cflowd command usage to modify configuration parameters.

Example:
config>cflowd# active-timeout 60
config>cflowd# no inactive-timeout
config>cflowd# overflow 2
config>cflowd# rate 10

The following is a sample Cflowd component configuration output.

A:ALA-1>config>cflowd# info 
#------------------------------------------
        active-timeout 60
        overflow 2
        rate 10
#------------------------------------------
A:ALA-1>config>cflowd# 

5.8.2. Modifying Cflowd Collector Parameters

Use the following syntax to modify Cflowd collector and aggregation parameters.

CLI Syntax:
config>cflowd#
collector ip-address[:port] [version version]
no collector ip-address[:port]
[no] aggregation
[no] as-matrix
[no] destination-prefix
[no] protocol-port
[no] raw
[no] source-destination-prefix
[no] source-prefix
[no] autonomous-system-type [origin | peer]
[no] description description-string
[no] shutdown
template-set {basic | mpls-ip}

If a specific collector UDP port is not identified, flows are sent to port 2055 by default.

The following sample output shows basic Cflowd modifications.

A:ALA-1>config>cflowd# info
-----------------------------------------
     active-timeout 60
        overflow 2
        rate 10
        collector 10.10.10.1:2000 version 5
            description "AS info collector"
        exit
        collector 10.10.10.2:5000 version 8
            aggregation
                source-prefix
                raw
            exit
            description "Test collector"
        exit
-----------------------------------------
A:ALA-1>config>cflowd#