This is a list of NetFlow best practices that I have compiled that I feel should be considered when exporting flow data. It is meant for software developers and consumers who are considering the export of flows for network traffic monitoring. The goal behind these NetFlow best practices is to ensure that you can accurately report on what is on the network.
When I started drafting this blog I kept returning to a few terms that I feel are very important but, shouldn’t be considered part of the 11 NetFlow best practices. I decided to write about these terms first because I think they are important issues when considering best at NetFlow practices. First make sure you understand some basic NetFlow terms:
The location where a router, switch or probe meters flow information (i.e. network traffic) is called the Observation Point (OP). The OP is a location in the appliance where IP packets can be observed. The most common location is the ingress interface although the egress interface is sometimes used as well. In IPFIX the location of the OP can be exported in the template.
Which either is the case - ingress or egress, the topic of ‘flowDirection’ Information Element (#61) should be understood. The flowDirection as defined in RFC 5102 is: The direction of the flow observed at the Observation Point.
5102bis: This document defines the datatypes and management policy for the information model for the IP Flow Information eXport (IPFIX) protocol. This information model is maintained as the IANA IPFIX Information Element Registry, the initial contents of which were defined by RFC 5102.
If the packets are metered as they enter an interface, the value of the ‘flowDirection’ must be 0 (i.e. ingress). If on the other hand the packets are metered as they exit the interface, the value of the ‘flowDirection’ must be 1 (i.e. egress).
Again, the Observation Point is the interface the flows were metered on. The flowDirection defines whether the flows were metered as they came in ‘ingress’ or went out ‘egress’ the interface. A detailed outline on when to meter flows ingressly or egressly is covered in another post.
Every Observation Point is associated with an Observation Domain (defined below) and that one Observation domain may be a superset of several other Observation Points. For example, one Observation domain can be an entire line card that would be the superset of the individual Observation Points at the line card's interfaces.
In its simplest form, an Observation Domain OD is a router or switch with multiple interfaces or OPs. However, a single line card with multiple interfaces could be an OD.
The Observation Domain is unique per exporting process and every OP is associated with an OD. Per RFC 5101, it is recommended that Observation Domain IDs also be unique per IPFIX device.
Best NetFlow Practices
In the process of helping over a dozen different vendors implement a flow export, a pattern of consistent problems has emerged.
Now that the concepts involved with proper flow exports are clear, it is time to make sure that you have invested in a proper NetFlow Collector as flow collection is an equally important part of a proper flow implementation.