Compare NetFlow v5, NetFlow v9, IPFIX and sFlow.
Show the answer
Say this first
NetFlow v5 exports fixed-format records about IPv4 flows only. v9 is template-based: the exporter first sends templates that describe the fields, so it can carry IPv6, MPLS and anything else. IPFIX is the IETF standard built from v9 (its header says version 10), adds variable-length and vendor-defined fields, and uses UDP 4739 by default. sFlow is different in kind: the device keeps no flow cache, it samples 1 in N packets and sends their headers plus interface counters to the collector.
Go deeper
What a flow is
A one-way stream of packets that share key fields. Traditional NetFlow uses seven keys: source and destination address, source and destination port, IP protocol, ToS byte and input interface. The device keeps flows in a cache and exports a record when a flow ends, when it goes idle (inactive timeout, 15 seconds by default) or when it has run for the active timeout (30 minutes by default on IOS). Set the active timeout to about 60 seconds, or long flows appear as spikes.
| NetFlow v5 | NetFlow v9 | IPFIX | sFlow | |
|---|---|---|---|---|
| Defined by | Cisco | Cisco, RFC 3954 | IETF, RFC 7011 | sFlow.org |
| Format | fixed 48-byte records | templates | templates, variable-length fields | sampled headers plus counters |
| IPv6, MPLS | no | yes | yes | yes, it sees raw headers |
| Flow cache on the device | yes | yes | yes | no |
| Usual collector port | UDP 2055 by convention | UDP 2055 by convention | UDP 4739 | UDP 6343 |
With v9 and IPFIX the collector cannot decode data until it has the template, so a collector that restarts shows a gap until the next template refresh.
Flexible NetFlow on IOS-XE
flow exporter EXP-COLLECTOR
destination 10.0.0.70
source Loopback0
transport udp 4739
export-protocol ipfix
!
flow monitor MON-V4
exporter EXP-COLLECTOR
record netflow ipv4 original-input
cache timeout active 60
!
interface GigabitEthernet0/0/0
ip flow monitor MON-V4 inputUses: top talkers, capacity planning, DDoS detection, security investigations, billing.
They will ask next
Should you monitor input, output or both?
Flows are one-way. Monitoring input on every interface sees each packet once. Adding output on the same interfaces counts traffic twice, so only do it when you need egress records and the collector knows how to handle them.
When would you pick sFlow over NetFlow or IPFIX?
On high-speed switches without flow cache hardware, or a multi-vendor switching fabric, where statistical sampling is good enough. When you need every flow, for security or billing, use a flow cache with IPFIX.
Traps
- Saying NetFlow captures packets. It summarises flows and carries no payload.
- Leaving the active timeout at 30 minutes and trusting the graphs.