I'm reading up on Netflow and playing around in PacketTracer. Currently I'm using ip flow ingress/egress only on my Routers gigabitEthernet. How much overhead is required, is Netflow supposed to be measured on all interfaces, even on switch trunklines?

  • this really isn't a security question - migrating
    – schroeder
    May 4 '16 at 16:56
  • It depends on where you want to measure the flow, and in which direction. Which data do you want to collect?
    – Ron Maupin
    May 4 '16 at 17:00
  • Thank you @RonMaupin I would like to measure everything, specifically monitor all the hosts traffic. Would it be justified to leave any interfaces out? Is Netflow a "heavy" service that would justify NOT having it in all interfaces in your opinion?
    – watez
    May 4 '16 at 17:29
  • If you think about it, there are "choke-points" in your network where you can measure the traffic.If you measure it at every interface in both directions, you will get duplicates. For instance, measuring both ingress and egress traffic on all your router interfaces will give you double the actual traffic measurements for all traffic traversing your router. Measuring only ingress (or egress) on all your router interfaces doesn't double your measurements. You need to decide where you want to measure it, and in which direction.
    – Ron Maupin
    May 4 '16 at 19:14

When you only have one Router, then you are fine monitoring both directions or both interfaces. If you monitor both directions and both interfaces, you will be monitoring duplicated flows.

The decision of where and what direction to monitor becomes a bit more ionvolved when more Router's are involved. Take this simple example:

Host X <----> Router A <----> Router B <----> Host Y

A packet going from Host X to Host Y will cross four total interfaces:

  • Ingress Router A's left interface
  • Egress Router A's right interface
  • Ingress Router B's left interface
  • Egress Router B's right interface

If you were capturing at every single one of these points, you would get the same flow data, duplicated four times. Which is obviously not very useful.

The simple solution is to just pick one of these to monitor, but then what of the return traffic? Imagine a packet going from Host Y to Host X, that packet would also cross four possible (what I'll call) Netflow capture points:

  • Ingress Router B's right interface
  • Egress Router B's left interface
  • Ingress Router A's right interface
  • Egress Router A's left interface

Obviously, capturing on all four of these points would also create 4x duplication of the traffic. So capturing on one of these would be sufficient.

A common practice is to deploy netflow on the ingress interfaces of all your 'access' routers. Which in the (again, simplistic) example above would mean setting up a capture at these points:

  • Ingress Router A's left interface
  • Ingress Router B's right interface

This accounts for picking from one of the four netflow capture points to cover the forward traffic (host X to Host Y) as well as the return traffic (Host Y to Host X), without capturing duplicated traffic in the process.

That said most production networks are significantly more complex (and rightfully so!) than what is pictured above. But you can still apply the same concept to determine the best place to set up your Netflow captures with the goal of capturing both forward and return traffic, and not duplicating any packets.

  • 1
    Even on a single router, if you measure the traffic both on ingress and on egress, you will measure it twice.
    – Ron Maupin
    May 4 '16 at 23:04
  • @RonMaupin You're right. I updated my answer w/ the correction.
    – Eddie
    May 4 '16 at 23:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.