Is NetFlow is an input side measurement technology

[mohd.sulaiman]

Hi

If netflow is enabled on 1 interface, does this measure input/incoming flows only?

my questions is if i need to measure the total traffic between 2 hosts behind 2 routers across a wan link . Do i need to enable netflow on both routers ?

example enable flow on ethernet interfaces of both routers?

Sulaiman

[rmushtaq]

By definition, a network flow is defined as a unidirectional sequence of packets between given source and destination endpoints. There are some good white papers and other relevant info on this at: http://www.cisco.com/warp/public/732/Tech/nmp/netflow/index.shtml which you can look at further.

[grayd]

NetFlow only collects information on the ingress interfaces. If you only enable NetFlow on Ethernet side for client 1, all you will see in the data that Client 1 sends to Client 2. However, to get the flow in the opposite direction, there are two options. You can either enable NetFlow on the Ethernet port of the router 2, or you can enable NetFlow on the interface of Router 1 that connects to Router 2.

[mohd.sulaiman]

Hi All

Thanks for the information.

BTW if the source and destination is between more than 2 routers , is it sufficient to enable on both ethernet interfaces where the source ,destination belongs?

or do i need to enable on the path to the destination ??

[grayd · Accepted solution]

You would only want to enable NetFlow on the source and destination routers. If you enable it on the intermediate routers, you would count the same packets multiple times.

[mohd.sulaiman]

gray

Thanks for the information, great help