Lab Objective:
The objective of this lab exercise is to learn how to monitor traffic that’s moving through the network device.
Lab Purpose:
NetFlow is a service that’s built into the Cisco IOS. It lets us monitor all the traffic that’s moving through it and generates some detailed traffic reporting in other data we can hand off. It’s used in several different places.
NetFlow has two components. First one is called the NetFlow collector. As the name implies, it gathers all the NetFlow data that’s coming to it. The other component is called the NetFlow exporter, which is the router in our case, as it would export the data.
Lab Tool:
Packet Tracer.
Lab Topology:
Please use the following topology to complete this lab exercise.
Lab Walkthrough:
Task 1:
Configure hostnames on R1 as illustrated in the topology.
Router#configure terminal
Router(config)#hostname R1
R1(config)#
Task 2:
Configure an IP address on the Gig0/0/0 interface of R1 as illustrated in the topology.
R1#configure terminal
R1(config)#interface gi0/0/0
R1(config-if)#ip address 192.168.10.1 255.255.255.0
R1(config-if)#no shut
Task 3:
Configure an IP address on the FastEthernet0 interface of the Server as illustrated in the topology.
Task 4:
Ping the R1’s Gi0/0/0 interface IP address from the server to make sure connectivity exists between the two. Use the desktop command prompt feature.
Task 5:
Enable the NetFlow feature on the Server. Ensure you press the ‘on’ radio button.
Task 6:
Configure NetFlow collection on the router interface using the ip flow IOS command.
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#interface gi0/0/0
R1(config-if)#ip flow ingress
R1(config-if)#
Task 7:
Configure R1 to send the flow records to the NetFlow collector. Packet Tracer uses UDP port 9996 for NetFlow.
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#ip flow-export destination 192.168.10.2 9996
R1(config)#ip flow-export version 9
R1(config)#
Task 8:
Ping the R1’s gi0/0/0 IP address from the Server to generate ICMP traffic
Task 9:
Use the show ip cache flow command on the ISR router to display the router’s NetFlow cache. This would show ICMP traffic flow between the Server and the Router.
R1#show ip cache flow
IP packet size distribution (17 total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
.000 .412 .000 .588 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000
IP Flow Switching Cache, 278544 bytes
0 active, 4096 inactive, 10 added
27 ager polls, 0 flow alloc failures
Active flows timeout in 30 minutes
Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 34056 bytes
0 active, 1024 inactive, 0 added, 0 added to flow
0 alloc failures, 0 force free
1 chunk, 1 chunk added
last clearing of statistics never
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
——– Flows /Sec /Flow /Pkt /Sec /Flow /Flow
ICMP 7 0.0 2 107 0.0 1.0 32.0
