13.09.2018

FastNetMon Netflow and IPFIX sampling configuration

That’s one of the most complicated topic about Netflow and IPFIX. If you can avoid using sampling and your hardware can handle Netflow without sampling, please do it. Otherwise, please read this guide carefully.

The simplest sampling configuration you can find in Netflow v5. Each packet carries sampling rate and FastNetMon can read it directly and it does not need any configuration. Also, for Netflow v5 FastNetMon ignores configuration options netflow_sampling_ratio even if you set it explicitly.

For Netflow v9 and IPFIX sampling information carried in special “options data” packets. Because Netflow v9 and IPFIX are extremely flexible protocols and each vendor can add new fields these protocols also use “template options” packets. They carry information about available fields in “options data” packets.

To decode information in “options data” packets each collector should read “template options” packets before.

FastNetMon 2.0.106 can decode such packets for Netflow v9 easily for most vendors but it cannot do it now with IPFIX. If you need it, please raise ticket to our support team.

To debug Netflow v9 sampling rate learning FastNetMon exposes number of useful counters.

First of all, we need “options templates” packets to decode “options data” packets:

sudo fcli show system_counters | grep netflow9_options_templates_number 
netflow9_options_templates_number                2

After that, FastNetMon should read “options data” packets:

sudo fcli show system_counters | grep netflow9_options_packet_number
netflow9_options_packet_number                   3

Finally, FastNetMon should extract sampling information from “options data” packets and it has counter about it too:

sudo fcli show system_counters | grep netflow9_custom_sampling_rate_received
netflow9_custom_sampling_rate_received 20

It means that FastNetMon decoded all these packets and successfully extracted sampling rate.

FastNetMon can maintain custom sampling rate for each devices and you can get list for all automatically extracted sampling rates this way:

sudo fcli show netflow_sampling_rates
10.12.22.1 1000

In addition to this, FastNetMon print following log messages on debug level (sudo fcli set main logging_level debug):

[DEBUG] Change sampling rate from 0 to 1000 for 10.12.22.1

In some cases, when vendor uses very unusual encoding way, FastNetMon cannot extract this information automatically and you can specify it manually this way. FastNetMon will use this information if it does not receive “options” packets from your router.

sudo fcli set main netflow_sampling_ratio 1000
sudo fcli set main netflow_custom_sampling_ratio_enable enable

Also, please share details about such cases with our technical support team to improve our parsers.

In all cases for Netflow v9 and IPFIX protocols sampling rate received from router has priority over information specified in configuration.

You can explicitly ignore sampling announcements from routers and use  value from configuration this way:

sudo fcli set main netflow_ignore_sampling_rate_from_device enable