NetFlow

[refram]

I've been interested in implementing MARS on my system. I've been reading up on it and am wondering if NetFlow is something that comes with an IOS, or with MARS, or if it's something that I have to buy separately.

[john.stark]

Netflow is something that is configured on a layer 3 device. You would have to check the license features on those routers or switches.

Cisco MARS is collector of netflow. Check the admin section for port configuration. Cisco MARS makes use of the netflow for network behaivor analysis. Netflow is generally used for network management but contains information that can be used by a security event manager like Cisco MARS.

Check out the following chapter for Cisco MARS on netflow.

Understanding NetFlow Anomaly Detection

http://www.cisco.com/en/US/products/ps6241/products_user_guide_chapter09186a008075038a.html

NetFlow Performance Analysis

http://www.cisco.com/en/US/tech/tk812/technologies_white_paper0900aecd802a0eb9.shtml

NetFlow Services Solutions Guide

http://www.cisco.com/en/US/products/sw/netmgtsw/ps1964/products_implementation_design_guide09186a00800d6a11.html