13.09.2018

FastNetMon Netflow and IPFIX sampling configuration

That’s one of the most complicated topic about Netflow and IPFIX. If you can avoid using sampling and your hardware can handle Netflow without sampling, please do it. Otherwise, please read this guide carefully.

The simplest sampling configuration you can find in Netflow v5. Each packet carries sampling rate and FastNetMon can read it directly. It does not need any configuration and works directly. Also, for Netflow v5 FastNetMon ignores configuration options netflow_sampling_ratio even if you set it explicitly.

For Netflow v9 and IPFIX sampling information carried in special “options data” packets. Because Netflow v9 and IPFIX are extremely flexible protocols and each vendor can add new fields these protocols also use “template options” packets. They carry information about available fields in “options data” packets.

To encode information in “options data” packets each collector should read “template options” packets before.

FastNetMon 2.0.106 can decode such packets for Netflow v9 easily for most vendors but it cannot do it now with IPFIX. If you need it, please raise ticket to our support team.

To debug Netflow v9 sampling rate learning FastNetMon exposes number of useful counters.

First of all, we need “options templates” packets to decode “options data” packets:

After that, FastNetMon should read “options data” packets:

Finally, FastNetMon should extract sampling information from “options data” packets and it has counter about it too:

It means that FastNetMon decoded all these packets and successfully extracted sampling rate.

FastNetMon can maintain custom sampling rate for each devices and you can get list for all automatically extracted sampling rates this way:

In addition to this, FastNetMon print following log messages on debug level (sudo fcli set main logging_level debug):

In some cases, when vendor uses very unusual encoding way, FastNetMon cannot extract this information automatically and you can specify it manually this way. FastNetMon will use this information if it does not receive “options” packets from your router.

Also, please share details about such cases with our technical support team to improve our parsers.