Lab Objective
Enable NetFlow on a router interface, configure a flow exporter pointing to a collector, and verify the resulting flow records accurately describe actual traffic traversing that interface.
Lab Purpose
While SPAN, covered in the previous lab, copies entire packets for deep inspection, NetFlow instead summarizes traffic into flow records (source, destination, ports, byte counts) without copying full packet contents — a far more scalable approach for long-term traffic analysis and capacity planning across many interfaces simultaneously.
Lab Topology
R1 ---- Gi0/0: 192.168.67.1/24 (LAN, traffic
to be monitored)
NetFlow collector: 192.168.67.100, listening
on UDP port 2055Task 1: Configure Basic Addressing
Configure R1's LAN interface.
Task 2: Configure a Flow Exporter
Define a flow exporter pointing to the collector's address and port.
Task 3: Configure a Flow Monitor
Create a flow monitor using standard IPv4 flow tracking, referencing the exporter.
Task 4: Apply the Flow Monitor to the Interface
Apply the flow monitor to Gi0/0 for both directions of traffic.
Task 5: Generate Traffic and Verify Flow Records
Generate traffic through the interface and confirm flow statistics are being collected locally, then verify the collector receives exported records.
Solution and Verification
R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.67.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exitR1(config)# flow exporter MY-EXPORTER
R1(config-flow-exporter)# destination 192.168.67.100
R1(config-flow-exporter)# transport udp 2055R1(config)# flow monitor MY-MONITOR
R1(config-flow-monitor)# exporter MY-EXPORTER
R1(config-flow-monitor)# record netflow ipv4 original-inputR1(config)# interface gigabitethernet0/0
R1(config-if)# ip flow monitor MY-MONITOR input
R1(config-if)# ip flow monitor MY-MONITOR outputPC-A> curl http://93.184.216.34
PC-A> ping 192.168.67.50R1# show flow monitor MY-MONITOR cache
SrcAddr DstAddr SrcPort DstPort Bytes Packets
192.168.67.10 93.184.216.34 52341 80 1284 9
192.168.67.10 192.168.67.50 0 0 420 5
-- Locally cached flow records already reflect
-- the generated traffic accurately, before
-- even confirming export succeeded-- On the collector (conceptual verification):
Collector received flow record:
Source: 192.168.67.10:52341
Destination: 93.184.216.34:80
Protocol: TCP
Bytes: 1284
-- Matches exactly what the local cache showedKey Takeaway
Unlike SPAN's complete packet mirroring, NetFlow produces compact summary records rather than full packet copies, making it practical to monitor traffic patterns across an entire network's worth of interfaces continuously without the storage and bandwidth overhead that mirroring every packet would require — the trade-off is losing full packet content, useful for volume and pattern analysis but not for the deep protocol-level inspection SPAN provides.