Netflow Application

The NetFlow application allows you to see visual representations of the data gathered by the Data Collection application, providing you with an interactive traffic-flow visualizer with detailed usage charts and tables on top conversations and hosts that are consuming the greatest bandwidth on your network. Because GoToAssist is offered on-demand, it provides valuable insight into bandwidth usage across the enterprise without the complexity and expense involved with deploying dedicated hardware and software probes. To get started, simply install this application and point a NetFlow probe on your router to the Crawler, which acts as the NetFlow collector (NetFlow is a network protocol developed by Cisco Systems for collecting IP traffic information).

Note: You must first install the NetFlow application before you can access and use it.

Topics in this article:

Configuring the NetFlow Application

Configuring the GoToAssist Crawler

Visualizer Tab

Details Tab

Configure Tab

Configuring the NetFlow Application

You must first configure your NetFlow tool to send data to your GoToAssist Crawler in order for you to view the data in GoToAssist’s NetFlow application. If you have not yet done so, you will see the following message when you open the NetFlow application: "No NetFlow data has been collected. If NetFlow data was available then you would be able to visualize it like the screenshot below."

To configure your Cisco router to export NetFlow data to your GoToAssist Crawler.

1. Run the following command using the IP address of the device that the GoToAssist Crawler is running on to export the NetFlow cache entries to a specified IP address. The Crawler listens for NetFlow on port 9996:
	ip flow-export destination <ip address of crawler> 9996
2. The GoToAssist Crawler understands version 5 NetFlow packets:
	ip flow-export version 5
3. By default, the router sends NetFlow information to your GoToAssist Crawler for long-lived flows every 30 minutes. However, you can get more immediate information about the flow in real time by breaking up long-lived flows into 1-minute fragments.

You can choose any number of minutes between 1 and 60. If you leave it at the default of 30 minutes, your traffic reports will have spikes.

It is important to set this value to 1 minute in order to generate alerts and view detailed data for troubleshooting purposes.
	ip flow-cache timeout active 1
4. To ensure that finished flows are periodically exported, run the following command. The default value is 15 seconds. You can choose any number of seconds between 10 and 600. However, if you choose a value greater than 250 seconds, the NetFlow analyzer may report traffic levels that are too low:
	ip flow-cache timeout inactive 15
5. To set ifIndex persistence (interface names) globally, run the following command. This ensures that the ifIndex values are persisted during device reboots. Otherwise, the flow data may appear inconsistent after rebooting, or reversed compared to previous values:
	snmp-server ifindex persist
6. Example of a router setup to send NetFlow to a Crawler:
router>enable
Password: <enable password goes here>
router#configure terminal
router(config)#interface FastEthernet 0/1
router(config-if)#ip route-cache flow
router(config-if)#exit
router(config)#ip flow-export destination <crawler ip goes here> 9996
router(config)#ip flow-export source FastEthernet 0/1
router(config)#ip flow-export version 5
router(config)#ip flow-cache timeout active 1
router(config)#ip flow-cache timeout inactive 15
router(config)#snmp-server ifindex persist
router(config)#^Z
router#write
7. NOTE: Select the interface you want to actually gather NetFlow data on. This is likely to be the WAN interface if you have a single router between your company and the internet.

8. To view your configurations, run the following commands:
	show ip flow export
and
	show ip cache flow

Configuring the GoToAssist Crawler

The GoToAssist Crawler collects NetFlow data automatically for devices on any subnets that the Crawler is monitoring. Usually no additional configuration of the Crawler is necessary. If your NetFlow router is outside a NAT firewall, then you must add the firewall's external subnet to the Crawler's networks to scan, to collect NetFlow data from that source. You may also want to add networks to your Crawler to collect NetFlow data from additional sources.

Visualizer Tab

You can use the NetFlow application to see your data in a graphic representation.

To see a graphic representation of data

1. Click the Visualizer tab in the NetFlow application.

2. Perform the following actions to access additional options:

Hover the mouse – When you hover over devices, you see additional IP Addresses available to use as a source.

Single-click the mouse – Clicking a device or flow show you a chart/graph of the history for that specific device.

Double-click the mouse – Double-clicking a flow pivots the view.

Details Tab

You can also view and manage the NetFlow data in charts and graphs.

To manage the NetFlow data in charts and graphs

1. Click the Details tab in the NetFlow application.

2. Use the following options to manipulate the data view:

Source IP – Change the Source IP address from the pull-down menu to display new data in the chart or graph.

Refresh – Click the green Refresh button to refresh the view based on new data.
Query – Click the Query icon to view and modify the query behind the data being displayed, or to modify the graph and charting formats.

List – Click a list, table, or chart icon to display the same data in a different format.

Community – Click the community icon to ask questions of the GoToAssist community.

Question – Hover over the gray question mark to display a label describing what the chart shows.

Live chart – Click a live port or source host from the charts themselves to drill down for more detail.
Red P – Click a red P to open Asset Search Results, where you can see device fingerprint and related data details.

Globe – Click the globe icon to see external information.

Traceroute – Click the traceroute icon to perform a traceroute to the IP address.

Whois – Click the whois icon to perform a 'whois' lookup on the IP address.

Configure Tab

You can see how much of your total inbound/outbound bandwidth is being used by specific flows by configuring the inbound and outbound bandwidth of a source, which then displays percentage numbers on the Details tab.

To configure inbound/outbound bandwidth

1. Click the Configure tab on the NetFlow application.

2. In the Source checkbox in the upper right, choose a source from the pop-up menu.

3. In the Inbound bandwidth checkbox, choose a bandwidth from the pop-up menu.

4. Click Save when finished.

See Cisco IOS NetFlow's support documentation for more information about using NetFlow.

| Views: 3228 | Last Updated: Thu, May 09 2013 2:28 PM