Some days before, I was reading IPFIX. But I was searching something which can help me to understand difference between IPFIX and Netlfow. As we all know Netflow is from Cisco. Many of Engineers are not aware that IPFIX is also flow export like Netflow. But it is
industry standard. Here let’s see difference between Netflow and IPFIX.
Netflow -
When Cisco first introduced NetFlow a while ago, it was a caching technique based on "flows". It still is, but the emphasis is now on statistics collection.
A network flow is a unidirectional stream of packets, identified by source and destination IP addresses, IP protocol, source and destination ports , and Type of Service byte. Inbound interface and other information can be tracked per flow. The crucial statistics tracked by NetFlow are packet and byte counts source to destination.
When you enable NetFlow on a router or switch, statistics are collected on the IP traffic passing through that device. The flow data can then be exported to a collection system aka Netflow server for post-processing and storage. Netflow analyzer software provides interactive reports to us as per our requirement.
NetFlow data export allows you to gather data from across a network about the traffic passing through that network.
For more information about Cisco Netflow Technical and configuration – Plz visit –
IPFIX -
The IETF has been working to standardize NetFlow for all vendors. The effort is named IPFIX, which stands for IP Flow Information eXport.
The IETF considered working implementations as a starting point, and elected to work from Cisco NetFlow version 9. Version 9 extends classic NetFlow by using templates to describe the flow records. This provides extensibility. The charter for the working group also lead them to allow securing the flow information -- SCTP secure stream transport can be used instead of TCP or UDP for transport. IPsec or TLS can also be used.
The IPFIX standard also allows for sampled data, which reduces the burden on devices of classifying and reporting on each and every packet. Cisco is recommending random sampling to ensure you don't miss flows.
Here have a look for IPFIX configuration for Maipu Router –
Maipu Router configuration:
| Command | Description |
| router(config)# int fastethernet1 | Enter the interface; the interface is connected to the internal management network. |
| router(config-if-fastethernet1)#ip address 50.1.1.1 255.255.255.0 | Configure the IP address. |
| router(config-if-fastethernet1)#exit | Exit the interface. |
| router(config)#ip flow enable | Enable the flow forwarding |
| router(config)#int fastethernet0 | Enter the interface; the interface is the IPFIX traffic monitoring point. |
| router(config-if-fastethernet0)#ip address 128.255.42.172 255.255.252.0 | Configure the IP address. |
| router(config-if-fastethernet0)#ip route-cache flow | Enable the flow forwarding on the interface. |
| router(config-if-fastethernet0)#ipfix ingress | Enable IPFIX on the interface and monitor the ingress traffic. |
| router(config-if-fastethernet0)#exit | Exit the interface |
| router(config)#ipfix destination 50.1.1.2 8888 | Configure the destination address of the IPfix packet and UDP destination port number |
| Command | Description |
| show ipfix statistics | To display the IPFIX statistics data |
| show ipfix flow interface-name {ingress | egress} [top top-N] | To display the current ingress/egress flow information o of the specified interface |
| clear ipfix statistics | To clear up the statistics data of the IPFIX |
Here is example output, not same with above configuration.
router#show ipfix flow g0 ingress
Displayed Result：
PRO SRC DST IF TOS SP DP PKTS BYTES
17 128.255.41.200 128.255.41.255 gigaethernet0 0 138 138 1 229
17 128.255.42.17 128.255.43.255 gigaethernet0 0 138 138 1 208
17 128.255.42.190 128.255.43.255 gigaethernet0 0 137 137 3 234
17 128.255.40.68 128.255.43.255 gigaethernet0 0 138 138 2 436
17 128.255.42.190 128.255.43.255 gigaethernet0 0 138 138 2 404
Description and analysis:
PRO: IP protocol number of the monitoring flow;
SRC: The IP source address of the monitoring flow;
DST: The IP destination address of the monitoring flow;
TOS: The TOS of the monitoring flow;
SP: The source port number of the monitoring flow;
DP: The destination port number of the monitoring flow;
PKTS: The packet statistics of the monitoring flow;
BYTES: The byte statistics of the monitoring flow;
The above information displays the current statistics information of all IP flows entering from g0.
Hope the above information is informative for you..
For feedback and queries, Plz comment with your mail id…
