NX-OS Netflow sampled mode – Explained & Configuration
Cisco NX-OS can gather NetFlow statistics in either full or sampled mode. Cisco NX-OS analyzes all packets on the interface or subinterface for full NetFlow mode. For sampled mode, you configure the rate at which Cisco NX-OS analyzes packets.
Cisco NX-OS supports sampled NetFlow. This feature samples incoming and outgoing packets on an interface. The packets sampled then qualify to create flows.
Sampled NetFlow reduces the amount of export data sent to the collector by limiting the number of packets that create flows and the number of flows. It is essential when flows are created on a line card or external device, instead of on the forwarding engine. F2, F2e, F3, and M3 Series modules support only sampled NetFlow.
The sampling mode supported on F2, F2e, F3, M3, M1, and M2 modules is M out of N, where M packets are selected randomly out of every N packet for sampling, and only those packets can create flows.
- Beginning with Cisco NX-OS Release 6.1(2), sampled NetFlow is supported on F2 and F2e Series modules.
- Beginning with Cisco NX-OS Release 6.2(6), sampled NetFlow is supported on F3 Series modules.
The accuracy of the sampled NetFlow compared with the traditional NetFlow is dependent on the sampling rate configured. If the sampling rate is 1:1, the sampled NetFlow is exactly accurate as of the traditional NetFlow. And if the sampling rate is 1:100, the sampled NetFlow is less accurate than the traditional, but it still yields statistical patterns that allow you to monitor the device.
1- Enable Netflow
2- Create Flow record and exporter
3- Create Flow Monitor
4- Create Sampler & Apply it with the flow monitor to the interface
The first three steps are detailed in this article, we will dive into sampler configuration and applying it with Flow monitor to the interface
You can create a flow sampler to define the NetFlow sampling rate for a flow.
|Command or Action||Purpose|
|Step 1||configure terminalExample:||Enters global configuration mode.|
|Step 2||sampler nameExample:||Creates a sampler and enters flow sampler configuration mode. You can enter up to 63 alphanumeric characters for the flow sampler name.|
|Step 3||(Optional) description stringExample:||(Optional)(Optional) Describes this sampler. You can enter up to 63 alphanumeric characters for the description.|
|Step 4||mode sample-number out-of packet-numberExample:||Defines the number of samples to take per the number of packets received. The sample-number range is from 1 to 64, and the packet-number range is from 1 to 65536 packets.|
|Step 5||exitExample:||Returns to global configuration mode.|
|Step 6||(Optional) copy running-config startup-configExample:||(Optional)Saves the change persistently through reboots and restarts by copying the running configuration to the startup configuration.|
Applying a Flow Monitor to an Interface
|Note||You can not apply a flow monitor to an egress interface, only ingress Netflow is supported.|
|Command or Action||Purpose|
|Step 1||configure terminal|
|Enters global configuration mode.|
|Step 2||interface interface-type slot/port|
|Enters interface configuration mode. The interface type can be Ethernet (including subinterfaces), port channel, or VLAN interface.|
|Step 3||ip flow monitor name input sampler name|
|Associates an IPv4 flow monitor and a sampler to the interface for input packets. You can enter up to 63 alphanumeric characters for the flow monitor name and the sampler name.|
|Step 4||ipv6 flow monitor name input sampler name|
|Associates an IPv6 flow monitor and a sampler to the interface for input packets. You can enter up to 63 alphanumeric characters for the flow monitor name and the sampler name.|
|Step 5||layer2-switched flow monitor name input sampler name|
|Associates a Layer 2-switched flow monitor and a sampler to the interface for input packets. You can enter up to 63 alphanumeric characters for the flow monitor name and the sampler name.|