Hands-On Lab: Configuring NetFlow

Lab Objective

Enable NetFlow on a router interface, configure a flow exporter pointing to a collector, and verify the resulting flow records accurately describe actual traffic traversing that interface.

Lab Purpose

While SPAN, covered in the previous lab, copies entire packets for deep inspection, NetFlow instead summarizes traffic into flow records (source, destination, ports, byte counts) without copying full packet contents — a far more scalable approach for long-term traffic analysis and capacity planning across many interfaces simultaneously.

Lab Topology

R1 ---- Gi0/0: 192.168.67.1/24 (LAN, traffic
                                 to be monitored)

NetFlow collector: 192.168.67.100, listening
on UDP port 2055

Task 1: Configure Basic Addressing

Configure R1's LAN interface.

Task 2: Configure a Flow Exporter

Define a flow exporter pointing to the collector's address and port.

Task 3: Configure a Flow Monitor

Create a flow monitor using standard IPv4 flow tracking, referencing the exporter.

Task 4: Apply the Flow Monitor to the Interface

Apply the flow monitor to Gi0/0 for both directions of traffic.

Task 5: Generate Traffic and Verify Flow Records

Generate traffic through the interface and confirm flow statistics are being collected locally, then verify the collector receives exported records.

Solution and Verification

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.67.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit

R1(config)# flow exporter MY-EXPORTER
R1(config-flow-exporter)# destination 192.168.67.100
R1(config-flow-exporter)# transport udp 2055

R1(config)# flow monitor MY-MONITOR
R1(config-flow-monitor)# exporter MY-EXPORTER
R1(config-flow-monitor)# record netflow ipv4 original-input

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip flow monitor MY-MONITOR input
R1(config-if)# ip flow monitor MY-MONITOR output

PC-A> curl http://93.184.216.34
PC-A> ping 192.168.67.50

R1# show flow monitor MY-MONITOR cache

SrcAddr        DstAddr         SrcPort  DstPort  Bytes  Packets
192.168.67.10  93.184.216.34   52341    80       1284   9
192.168.67.10  192.168.67.50   0        0        420    5
-- Locally cached flow records already reflect
-- the generated traffic accurately, before
-- even confirming export succeeded

-- On the collector (conceptual verification):

Collector received flow record:
  Source: 192.168.67.10:52341
  Destination: 93.184.216.34:80
  Protocol: TCP
  Bytes: 1284
-- Matches exactly what the local cache showed

Key Takeaway

Unlike SPAN's complete packet mirroring, NetFlow produces compact summary records rather than full packet copies, making it practical to monitor traffic patterns across an entire network's worth of interfaces continuously without the storage and bandwidth overhead that mirroring every packet would require — the trade-off is losing full packet content, useful for volume and pattern analysis but not for the deep protocol-level inspection SPAN provides.