Netmon Docs · Device Configuration Guide

Cisco IOS & IOS-XEv7.0.20

Set up local SPAN mirroring and NetFlow export on Cisco Catalyst switches and ISR/ASR routers so Netmon can see the traffic crossing them.

Covers Catalyst switches and ISR/ASR routers running classic Cisco IOS or IOS-XE. IOS-XE platforms (including modern Catalyst 9000 switches) require Flexible NetFlow; older classic IOS routers can use Traditional NetFlow instead.

Mirror traffic (SPAN)

Local SPAN copies traffic from one or more source ports to a destination port wired to a Netmon sniffer NIC. Configure both the source and the destination in global configuration mode.

  1. Enter global configuration mode.

    Device> enable
Device# configure terminal

  2. Define the SPAN source port(s) to monitor. Use the both keyword to copy received and transmitted traffic (rx or tx capture a single direction). The session number range is 1 to 66.

    Device(config)# monitor session 1 source interface <source-interface> both

  3. Define the SPAN destination port — the physical interface connected to the Netmon sniffer NIC. Use the same session number as the source.

    Device(config)# monitor session 1 destination interface <destination-interface>

  4. Return to privileged EXEC mode and save.

    Device(config)# end
Device# copy running-config startup-config
Note

The destination interface must be a physical interface. A SPAN destination port carries only mirrored traffic and does not forward normal switched traffic while it is a SPAN destination.

Important

SPAN can oversubscribe the destination port — if the combined source traffic exceeds the destination link speed, packets are dropped before they reach Netmon. Mirror only the ports you need, or split high-volume sources across separate sessions.

On the Netmon side, set the receiving NIC to Sniffer (manual) — see Receiving the Data in Netmon.

Source: Network Management Configuration Guide, Cisco IOS XE Amsterdam 17.3.x (Catalyst 9300 Switches) — Configuring SPAN and RSPAN. https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-3/configuration_guide/nmgmt/b_173_nmgmt_9300_cg/configuring_span_and_rspan.html

Export flow data

Netmon’s flow collector listens for NetFlow v9 on UDP 9996. Cisco’s default export UDP port is not 9996, so you must set the port explicitly. NetFlow v9 is recommended.

Flexible NetFlow (IOS-XE — required)

  1. Enter global configuration mode and create a flow record. The two collect timestamp absolute lines are required for Netmon to time-correlate flows.

    Device# configure terminal
Device(config)# flow record record1
Device(config-flow-record)# match ipv4 source address
Device(config-flow-record)# match ipv4 destination address
Device(config-flow-record)# match ipv4 protocol
Device(config-flow-record)# match transport source-port
Device(config-flow-record)# match transport destination-port
Device(config-flow-record)# collect counter
Device(config-flow-record)# collect timestamp absolute first
Device(config-flow-record)# collect timestamp absolute last
Device(config-flow-record)# exit

  2. Create a flow exporter pointing at Netmon. Set transport udp 9996, the v9 export protocol, and set the exporter source to the interface whose IP address Netmon knows the device by (commonly Loopback0).

    Device(config)# flow exporter export1
Device(config-flow-exporter)# destination <netmon-ip>
Device(config-flow-exporter)# source Loopback0
Device(config-flow-exporter)# transport udp 9996
Device(config-flow-exporter)# export-protocol netflow-v9
Device(config-flow-exporter)# exit

  3. Create a flow monitor binding the record and the exporter together.

    Device(config)# flow monitor monitor1
Device(config-flow-monitor)# record record1
Device(config-flow-monitor)# exporter export1
Device(config-flow-monitor)# exit

  4. Apply the flow monitor to each monitored interface in the ingress direction.

    Device(config)# interface <interface>
Device(config-if)# ip flow monitor monitor1 input
Device(config-if)# end
Note

Setting source Loopback0 (or another stable interface) fixes the exporter’s source IP so it matches the address Netmon uses to identify the device. If the source IP differs, flows may be attributed to the wrong device or rejected.

Traditional NetFlow (classic IOS routers)

On older classic IOS routers, enable NetFlow data export globally and then enable NetFlow on each Layer 3 interface.

  1. Enter global configuration mode and set the export destination to Netmon on UDP 9996.

    Router> enable
Router# configure terminal
Router(config)# ip flow-export destination <netmon-ip> 9996

  2. Set the export source interface (so the source IP matches the address Netmon knows the device by) and select Version 9.

    Router(config)# ip flow-export source <interface>
Router(config)# ip flow-export version 9

  3. Enable NetFlow capture on each monitored Layer 3 interface.

    Router(config)# interface <interface>
Router(config-if)# ip flow ingress
Router(config-if)# end
Important

Traditional NetFlow (ip flow-export / ip flow ingress) is not supported on IOS-XE platforms — use Flexible NetFlow there. If ip flow-export version 9 is not accepted on a very old image, that platform predates v9 support and only v5 is available.

On the Netmon side, enable Allow Netflow Data Collection for this device — see Receiving the Data in Netmon.

Source: Flexible NetFlow, Cisco IOS XE 17 (Catalyst 9000). https://www.cisco.com/c/en/us/td/docs/switches/lan/c9000/fnf-avc/flexible-netflow-configuration-guide.html

Source: NetFlow Configuration Guide, Cisco IOS Release 15S — Configuring NetFlow and NetFlow Data Export. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_pi/configuration/15-s/nf-15-s-book/cfg-nflow-data-expt.html

PreviousGuide home NextCisco Nexus (NX-OS)