Appendix A Remote Network Monitoring

Transcription

1 Appendix A Remote Network Monitoring This appendix describes the remote monitoring features available on HP products: Remote Monitoring (RMON) statistics All HP products support RMON statistics on the individual port level. See RMON Support on page A-3. NetFlow NetFlow collects statistical data for traffic flows on an HP device and exports the flow data to accounting and billing applications. Netflow is supported only on a 9300 chassis with a T-flow module. See NetFlow on page A-8. sflow sflow collects interface statistics and traffic samples from individual interfaces on an HP device and exports the information to a monitoring server. sflow is supported on 9300, T-flow, EP, and 10-Gigabit modules, and on 948sl modules. See sflow on page A-30. Basic Management The following sections contain procedures for basic system management tasks. Viewing System Information You can access software and hardware specifics for a ProCurve Routing Switch. USING THE CLI To view the software and hardware details for the system, enter the show version command: ProCurveRS# show version Syntax: show version USING THE WEB MANAGEMENT INTERFACE 1. Log on to the device using a valid user name and password for read-only or read-write access. The System configuration dialog is displayed. 2. Click on the plus sign next to Monitor in the tree view to expand the list of monitoring options. 3. Click on the Device link to display the Device Information panel. Viewing Configuration Information You can view a variety of configuration details and statistics with the show option. The show option provides a convenient way to check configuration changes before saving them to flash. The show options available will vary by configuration level. June 2005 A - 1

2 Advanced Configuration and Management Guide for ProCurve 9300/9400 Series Routing Switches USING THE CLI To determine the available show commands for the system or a specific level of the CLI, enter the following command: ProCurveRS# show? Syntax: show <option> You also can enter show at the command prompt, then press the TAB key. NOTE: For a complete summary of all available show... CLI commands and their displays, see the Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches. USING THE WEB MANAGEMENT INTERFACE 1. Log on to the device using a valid user name and password for read-only or read-write access. The System configuration dialog is displayed. 2. Click on the plus sign next to Monitor in the tree view to expand the list of monitoring options. 3. If needed, click on the plus sign next to a subcategory to display the monitoring links for that category. 4. Click on the link for the information you want to view. Viewing Port Statistics Port statistics are polled by default every 10 seconds. USING THE CLI You can view statistics for ports by entering the following show commands: show interfaces show configuration USING THE WEB MANAGEMENT INTERFACE To view the port statistics for all ports on a Routing Switch: 1. Log on to the device using a valid user name and password for read-only or read-write access. The System configuration dialog is displayed. 2. Click on the plus sign next to Monitor in the tree view to expand the list of monitoring options. 3. Click on the plus sign next to Port to expand the list of port monitoring options. 4. Click on the plus sign next to Statistics to expand its options. 5. Select the link to the port type you want (for example, Ethernet) to display the Port Statistics table. Viewing STP Statistics You can view a summary of STP statistics for Routing Switches. STP statistics are by default polled every 10 seconds. To modify this polling rate (when using the Web management interface), select the Preferences link from the main menu, and modify the STP field. You can disable polling by setting the field to zero. USING THE CLI To view spanning tree statistics, enter the show span command. To view STP statistics for a VLAN, enter the span vlan command. USING THE WEB MANAGEMENT INTERFACE 1. Log on to the device using a valid user name and password for read-only or read-write access. The System configuration dialog is displayed. 2. Click on the plus sign next to Monitor in the tree view to expand the list of monitoring options. A - 2 June 2005

3 Remote Network Monitoring 3. Select the STP link. Clearing Statistics You can clear statistics for many parameters with the clear option. USING THE CLI To determine the available clear commands for the system, enter the following command: ProCurveRS# clear? Syntax: clear <option> You also can enter clear at the command prompt, then press the TAB key. For a complete summary of all available clear... CLI commands and their displays, see the Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches. NOTE: Clear commands are found at the Privileged EXEC level. USING THE WEB MANAGEMENT INTERFACE You can clear statistics by doing the following: 1. Log on to the device using a valid user name and password for read-write access. The System configuration dialog is displayed. 2. Click on the plus sign next to Command in the tree view to expand the list of command options. 3. Click on the Clear link to display the Clear panel. 4. Select all items to be cleared. 5. Click Apply. RMON Support The HP RMON agent supports the following groups. The group numbers come from the RMON specification (RFC 1757). Statistics (RMON Group 1) History (RMON Group 2) Alarms (RMON Group 3) Events (RMON Group 9) The CLI allows you to make configuration changes to the control data for these groups, but you need a separate RMON application to view and display the data graphically. Statistics (RMON Group 1) Count information on multicast and broadcast packets, total packets sent, undersized and oversized packets, CRC alignment errors, jabbers, collision, fragments and dropped events is collected for each port on a ProCurve Routing Switch. No configuration is required to activate collection of statistics for the Routing Switch. This activity is by default automatically activated at system start-up. June 2005 A - 3

4 Advanced Configuration and Management Guide for ProCurve 9300/9400 Series Routing Switches USING THE CLI You can view a textual summary of the statistics for all ports by entering the following CLI command: ProCurveRS(config)# show rmon statistics Ethernet statistics 1 is active, owned by monitor Interface 1/1 (ifindex 1) counters Octets 0 Drop events Broadcast pkts CRC alignment errors Oversize pkts Jabbers 64 octets pkts 128 to 255 octets pkts 512 to 1023 octets pkts Packets Multicast pkts Undersize pkts Fragments Collisions 65 to 127 octets pkts 256 to 511 octets pkts 1024 to 1518 octets pkts Syntax: show rmon statistics [<portnum>] The <portnum> parameter specifies the port number. You can use the physical port number or the SNMP port number. The physical port number is based on the product. The ports are numbered according to slot and port. For example, the first port in slot 1 is 1/1. The third port in slot 7 is 7/3. The SNMP numbers of the ports start at 1 and increase sequentially. For example, if slot 1 contains an 8-port module, the SNMP number of the first port in slot 2 is 9. The physical port number of the same port is 2/1. This command shows the following information. Table A.1: Export Configuration and Statistics This Line... Octets Drop events Packets Broadcast pkts Displays... The total number of octets of data received on the network. This number includes octets in bad packets. This number does not include framing bits but does include Frame Check Sequence (FCS) octets. Indicates an overrun at the port. The port logic could not receive the traffic at full line rate and had to drop some packets as a result. The counter indicates the total number of events in which packets were dropped by the RMON probe due to lack of resources. This number is not necessarily the number of packets dropped, but is the number of times an overrun condition has been detected. The total number of packets received. This number includes bad packets, broadcast packets, and multicast packets. The total number of good packets received that were directed to the broadcast address. This number does not include multicast packets. A - 4 June 2005

5 Remote Network Monitoring Table A.1: Export Configuration and Statistics (Continued) This Line... Multicast pkts CRC alignment errors Undersize pkts Fragments Oversize packets Jabbers Collisions 64 octets pkts Displays... The total number of good packets received that were directed to a multicast address. This number does not include packets directed to the broadcast address. The total number of packets received that were from octets long, but had either a bad FCS with an integral number of octets (FCS Error) or a bad FCS with a non-integral number of octets (Alignment Error). The packet length does not include framing bits but does include FCS octets. The total number of packets received that were less than 64 octets long and were otherwise well formed. This number does not include framing bits but does include FCS octets. The total number of packets received that were less than 64 octets long and had either a bad FCS with an integral number of octets (FCS Error) or a bad FCS with a non-integral number of octets (Alignment Error). It is normal for this counter to increment, since it counts both runts (which are normal occurrences due to collisions) and noise hits. This number does not include framing bits but does include FCS octets. The total number of packets received that were longer than 1518 octets and were otherwise well formed. This number does not include framing bits but does include FCS octets. The total number of packets received that were longer than 1518 octets and had either a bad FCS with an integral number of octets (FCS Error) or a bad FCS with a non-integral number of octets (Alignment Error). Note: This definition of jabber is different from the definition in IEEE section (10BASE5) and section (10BASE2). These documents define jabber as the condition where any packet exceeds 20 ms. The allowed range to detect jabber is between 20 ms and 150 ms. This number does not include framing bits but does include FCS octets. The best estimate of the total number of collisions on this Ethernet segment. The total number of packets received that were 64 octets long. This number includes bad packets. This number does not include framing bits but does include FCS octets. June 2005 A - 5

6 Advanced Configuration and Management Guide for ProCurve 9300/9400 Series Routing Switches Table A.1: Export Configuration and Statistics (Continued) This Line to 127 octets pkts 128 to 255 octets pkts 256 to 511 octets pkts 512 to 1023 octets pkts 1024 to 1518 octets pkts Displays... The total number of packets received that were octets long. This number includes bad packets. This number does not include framing bits but does include FCS octets. The total number of packets received that were octets long. This number includes bad packets. This number does not include framing bits but does include FCS octets. The total number of packets received that were octets long. This number includes bad packets. This number does not include framing bits but does include FCS octets. The total number of packets received that were octets long. This number includes bad packets. This number does not include framing bits but does include FCS octets. The total number of packets received that were octets long. This number includes bad packets. This number does not include framing bits but does include FCS octets. USING THE WEB MANAGEMENT INTERFACE To view the RMON statistics for the system: 1. Log on to the device using a valid user name and password for read-only or read-write access. The System configuration dialog is displayed. 2. Click on the plus sign next to Monitor in the tree view to expand the list of monitoring options. 3. Click on the plus sign next to RMON in the tree view to expand the list of option links. 4. Click on the Statistics link to display the RMON Statistic table. The same statistics as those listed for the CLI are displayed. NOTE: The number of entries in a RMON statistics table directly corresponds to the number of ports on a system. For example, if the system is a 26 port device, there will be 26 entries in the statistics display. History (RMON Group 2) All active ports by default will generate two history control data entries per active ProCurve Routing Switch interface. An active port is defined as one with a link up. If the link goes down the two entries are automatically be deleted. A - 6 June 2005

7 Remote Network Monitoring Two history entries are generated for each device: a sampling of statistics every 30 seconds a sampling of statistics every 30 minutes The history data can be accessed and displayed using any of the popular RMON applications USING THE CLI A sample RMON history command and its syntax is shown below: ProCurveRS(config)# rmon history 1 interface 1 buckets 10 interval 10 owner nyc02 Syntax: rmon history <entry-number> interface <portnum> buckets <number> interval <sampling-interval> owner <text-string> You can modify the sampling interval and the bucket (number of entries saved before overwrite) using the CLI. In the above example, owner refers to the RMON station that will request the information. NOTE: To review the control data entry for each port or interface, enter the show rmon history command. USING THE WEB MANAGEMENT INTERFACE 1. Log on to the device using a valid user name and password for read-only or read-write access. The System configuration dialog is displayed. 2. Click on the plus sign next to Monitor in the tree view to expand the list of monitoring options. 3. Click on the plus sign next to RMON in the tree view to expand the list of option links. 4. Click on the History link to display the RMON History table. Alarm (RMON Group 3) Alarm is designed to monitor configured thresholds for any SNMP integer, time tick, gauge or counter MIB object. Using the CLI, you can define what MIB objects are monitored, the type of thresholds that are monitored (falling, rising or both), the value of those thresholds, and the sample type (absolute or delta). An alarm event is reported each time that a threshold is exceeded. The alarm entry also indicates the action (event) to be taken if the threshold be exceeded. USING THE CLI A sample CLI alarm entry and its syntax is shown below: ProCurveRS(config)# rmon alarm 1 ifinoctets.6 10 delta rising-threshold falling threshold 50 1 owner nyc02 Syntax: rmon alarm <entry-number> <MIB-object.interface-num> <sampling-time> <sample-type> <threshold-type> <threshold-value> <event-number> <threshold-type> <threshold-value> <event-number> owner <text-string> USING THE WEB MANAGEMENT INTERFACE This display is not supported on the Web management interface. Event (RMON Group 9) There are two elements to the Event Group the event control table and the event log table. The event control table defines the action to be taken when an alarm is reported. Defined events can be found by entering the CLI command, show event. The Event Log Table collects and stores reported events for retrieval by an RMON application. June 2005 A - 7

8 Advanced Configuration and Management Guide for ProCurve 9300/9400 Series Routing Switches USING THE CLI A sample entry and syntax of the event control table is shown below: ProCurveRS(config)# rmon event 1 description testing a longer string log-and-trap public owner nyc02 Syntax: rmon event <event-entry> description <text-string> log trap log-and-trap owner <rmon-station> USING THE WEB MANAGEMENT INTERFACE This display is not supported on the Web management interface. NetFlow NetFlow is a feature that collects information about the traffic that your 9300 series Chassis device receives and forwards, and exports that information to external third-party data collectors. NetFlow-compatible accounting and billing applications can use the exported information to create reports, bill customers for network usage, and so on. The traffic information is collected and exported as flows. A flow consists of the following information: Ingress port (the port that receives the traffic) Egress port (the port out which the traffic is forwarded) Source IP address Destination IP address IP Protocol type (IP, ICMP, TCP, UDP, and so on) Source TCP or UDP port Destination TCP or UDP port Type of Service (ToS) TCP flags Traffic collection occurs for the interfaces on which you enable NetFlow. NetFlow uses the Layer 4 session table as its flow cache. The session table is active regardless of the state of NetFlow and is used as a fast-path for forwarding IP packets based on Layer 3 and Layer 4 information. By using the session table, NetFlow ensures that the exported data reflects the traffic that has actually been forwarded, and thus excludes traffic that is filtered out without being forwarded. The T-Flow has a separate flow cache (Layer 4 session table) on the VM and on each TSP CPU. VM flow cache This flow cache contains entries for broadcast traffic, multicast traffic, and for traffic addressed to the HP device itself. The VM also contains the aggregate caches, if configured. TSP CPU flow caches The flow cache on a given TSP CPU contains entries for traffic that is forwarded on that module. You can display and change the maximum flow cache size separately for the VM and for each TSP CPU. NOTE: Other features including ACLs, rate limiting, Policy-based Routing (PBR) and Network Address Translation (NAT) also use the Layer 4 session table. If you change the session table size, the change can affect all these features. For information about how the forwarding modules are allocated to the TSP CPUs, see the Using the T-Flow Module chapter in the Installation and Basic Configuration Guide for ProCurve 9300 Series Routing Switches. Hardware Support Netflow is supported only with a T-flow module in a ProCurve series 9300 routing switch. A - 8 June 2005

9 Remote Network Monitoring Flow Aging and Export NetFlow collects and exports flows once they age out of the flow cache (session table). NetFlow ages a flow out of the flow cache (session table) when one of the following occurs: The flow is for a TCP session and the session has been terminated normally by a TCP FIN or RST packet. The flow is inactive. By default, an inactive flow is one that has not been used within the last 60 seconds as a fast-path to forward a packet. You can change the age for inactive flows to a value from seconds. The flow has been active for a long time. By default, an active flow is aged out after 30 minutes. You can change the age for active flows to a value from 1 60 minutes. The cache is full and NetFlow needs room for new entries. By default, NetFlow exports all the aged out flows for all the interfaces on which you enable Flow Switching. You can streamline flow export using the following methods: Disable export for specific transport protocols. You can disable export of flows for TCP traffic, flows for UDP traffic, or all flows except flows or TCP or UDP traffic. Configure aggregate caches. An aggregate cache aggregates separate flows into a single flow based on specific information, and exports the aggregated flow instead of the individual flows. See Aggregate Caches. Aggregate Caches By default, NetFlow creates and exports a separate flow for each unique combination of the flow information. To streamline data export, you can configure additional, aggregate caches, to aggregate flows based on specific data and export the aggregate flows instead of individual flows. The collector receives the aggregate flows instead of the individual flows. NetFlow supports the following types of aggregate caches. For each cache, the information by which the flows are aggregated is listed. Autonomous System (AS) Input and output interfaces Source and destination BGP4 AS Source prefix Input interface Source network mask and prefix (for example, /24) Source BGP4 AS Destination prefix Output interface Destination network mask and prefix Destination BGP4 AS Source and destination prefix Input and output interfaces Source and destination network masks and prefixes Source and destination BGP4 AS IP protocol and application port Source and destination IP protocol Source and destination TCP or UDP port numbers, if the IP protocol is 6 (TCP) or 17 (UDP) June 2005 A - 9

10 Advanced Configuration and Management Guide for ProCurve 9300/9400 Series Routing Switches The aggregate caches are separate from the main flow cache. When a flow is aged out of the flow cache, the flow is moved to the applicable aggregate cache, where it is aggregated with other flows. The aggregate flows are then exported to the collector. You can configure one or more of the aggregate caches, up to all five of them. Parameter settings for the main flow cache and aggregate caches are independent. Changing a parameter setting for one cache does not affect the setting for the same parameter in other caches. NOTE: Aggregate caching does not reduce the amount of NetFlow traffic collected for individual interfaces. Each module locally collects non-aggregated flows, then sends them to the T-Flow, which aggregates them in the appropriate caches for export. Collectors NetFlow packages the expired flows into UDP packets and sends the packets to external devices called collectors. When you configure a collector on the HP device, you specify its IP address and the UDP port number to receive the exported flows. You can use a total of 15 collectors. You can specify up to 10 collectors for the main flow cache, and one additional collector for each aggregate cache. If you specify more than one collector for the main cache, NetFlow load balances the flows that it exports from the main cache based on the source IP addresses of the flows. Load balancing does not apply to the flows exported from the aggregate caches. Source Interfaces By default, the HP device uses the interface that is connected to a given collector as the source interface for that collector. You can change the source interface for a collector to one of the following: Ethernet port NetFlow sends the export packets out the specified interface. Loopback interface NetFlow sends the export packets from the specified loopback address, using a physical port connected to the collector to transmit the packet. Null interface NetFlow continues to collect flows but does not export them to the collector. Use this type of interface when you want to administratively stop flow export without stopping flow collection and without removing configuration information. Export Packet Format Versions NetFlow places flows into UDP packets and sends the packets to the collector. The format version of the packets can differ depending on the type of information you want to export. The HP implementation of NetFlow supports the following format versions: Version 1 Version 1 NetFlow export packets contain basic flow information used by early versions of NetFlow-based applications. The information includes ingress and egress ports, IP protocol, source and destination IP addresses and TCP or UDP ports, and IP ToS values. Version 5 Version 5 contains all the information in Version 1 packets, and adds information for Border Gateway Protocol version 4 (BGP4) AS numbers, as well as flow sequence numbers. This is the default. Version 8 Version 8 supports aggregate flows. When you enable an aggregate cache, the software automatically uses format 8 for export flows from the aggregate cache. Version 1 or 5 is still used for exported flows from the main cache. A - 10 June 2005

11 Remote Network Monitoring Format Version 1 Table A.2 lists the fields in format version 1 NetFlow packets. Table A.2: NetFlow Format Version 1 Field Description Header Fields UINT16 version UINT16 count UINT32 SysUptime UINT32 unix_secs UINT32 unix_nsecs Current version (1) Number of records in this PDU Current time in msecs since the HP device was booted Current seconds since 0000 UTC 1970 Residual nanoseconds since 0000 UTC 1970 Flow Data Fields ipaddrtype srcaddr ipaddrtype dstaddr ipaddrtype nexthop UINT16 input UINT16 output UINT32 dpkts UINT32 doctets UINT32 First UINT32 Last UINT16 srcport UINT16 dstport UINT16 pad UINT8 prot UINT8 tos UINT8 tcp_flags UINT8 pad UINT16 pad UINT32 reserved Source IP Address Destination IP Address Next hop router's IP Address Input interface index Output interface index Packets sent in Duration (milliseconds between first and last packet in this flow) Octets sent in Duration (milliseconds between first and last packet in this flow) SysUptime at start of flow SysUptime of last packet of the flow TCP/UDP source port number (FTP, Telnet, and so on) TCP/UDP destination port number Pad to word boundary IP protocol (6=TCP, 17=UDP, and so on) IP Type of Service (ToS) Cumulative OR of TCP flags Pad to word boundary Pad to word boundary Reserved for future use June 2005 A - 11

12 Advanced Configuration and Management Guide for ProCurve 9300/9400 Series Routing Switches Format Version 5 Table A.3 lists the fields in format version 5 NetFlow packets. Table A.3: NetFlow Format Version 5 Field Description Header Fields UINT16 version UINT16 count UINT32 SysUptime UINT32 unix_secs UINT32 unix_nsecs UINT32 flow_sequence UINT8 engine_type UINT8 engine_id UINT16 reserved Current version (1) Number of records in this PDU Current time in msecs since the HP device was booted Current seconds since 0000 UTC 1970 Residual nanoseconds since 0000 UTC 1970 Sequence number of total flows seen Type of flow switching engine Slot number of the flow switching engine Reserved for future use Flow Data Fields ipaddrtype srcaddr ipaddrtype dstaddr ipaddrtype nexthop UINT16 input UINT16 output UINT32 dpkts UINT32 doctets UINT32 First UINT32 Last UINT16 srcport UINT16 dstport UINT8 pad UINT8 tcp_flags UINT8 prot UINT8 tos UINT16 dst_as UINT16 src_as Source IP Address Destination IP Address Next hop router's IP Address Input interface index Output interface index Packets sent in Duration (milliseconds between first and last packet in this flow) Octets sent in Duration (milliseconds between first and last packet in this flow) SysUptime at start of flow SysUptime of last packet of the flow TCP/UDP source port number (FTP, Telnet, and so on) TCP/UDP destination port number Pad to word boundary Cumulative OR of TCP flags IP protocol (6=TCP, 17=UDP, and so on) IP Type of Service (ToS) Destination peer/origin Autonomous System Source peer/origin Autonomous System A - 12 June 2005

13 Remote Network Monitoring Table A.3: NetFlow Format Version 5 (Continued) Field UINT8 dst_mask UINT8 src_mask UINT16 pad Description Destination route's mask bits Source route's mask bits Pad to word boundary Format Version 8 Table A.4 lists the fields in format version 8 NetFlow packets. Version 8 is used to export aggregated flows. Each of the aggregate cache types has a different format, as shown in the table. Table A.4: NetFlow Format Version 8 Field Description Header Fields UINT16 version UINT16 count UINT32 SysUptime UINT32 unix_secs UINT32 unix_nsecs UINT32 flow_sequence UINT8 engine_type UINT8 engine_id UINT8 aggregation UINT8 agg_version UINT32 reserved Current version (1) Number of records in this PDU Current time in msecs since the HP device was booted Current seconds since 0000 UTC 1970 Residual nanoseconds since 0000 UTC 1970 Sequence number of total flows seen Type of flow switching engine Slot number of the flow switching engine Aggregation method being used Version of the aggregation export (2) Reserved for future use Flow Data Fields for AS Aggregation Flows UINT32 flows UINT32 dpkts UINT32 doctets UINT32 First UINT32 Last UINT16 src_as UINT16 dst_as UINT16 input UINT16 output Number of flows Packets sent in Duration Octets sent in Duration SysUptime at start of flow SysUptime of last packet of flow Originating AS of source address Originating AS of destination address Input interface index Output interface index June 2005 A - 13

14 Advanced Configuration and Management Guide for ProCurve 9300/9400 Series Routing Switches Table A.4: NetFlow Format Version 8 (Continued) Field Description Flow Data Fields for Protocol Port Flows UINT32 flows UINT32 dpkts UINT32 doctets UINT32 First UINT32 Last UINT8 prot UINT8 pad UINT16 reserved UINT16 srcport UINT16 dstport Number of flows Packets sent in Duration Octets sent in Duration SysUptime at start of flow SysUptime of last packet of flow IP protocol (6=TCP, 17=UDP, and so on) Pad to word boundary Reserved for future use TCP/UDP source port number (FTP, Telnet, and so on) TCP/UDP destination port number Flow Data Fields for Source Prefix Flows UINT32 flows UINT32 dpkts UINT32 doctets UINT32 First UINT32 Last ipaddrtype src_prefix UINT8 src_mask UINT8 pad UINT16 src_as UINT16 input Number of flows Packets sent in Duration Octets sent in Duration SysUptime at start of flow SysUptime of last packet of flow Source prefix Source address prefix mask bits Pad to word boundary Originating AS of source address Input interface index Flow Data Fields for Destination Prefix Flows UINT32 flows UINT32 dpkts UINT32 doctets UINT32 First UINT32 Last ipaddrtype dst_prefix UINT8 dst_mask UINT8 pad UINT16 dst_as Number of flows Packets sent in Duration Octets sent in Duration SysUptime at start of flow SysUptime of last packet of flow Destination prefix Destination address prefix mask bits Pad to word boundary Originating AS of destination address A - 14 June 2005

15 Remote Network Monitoring Table A.4: NetFlow Format Version 8 (Continued) Field UINT16 output Description Output interface index Flow Data Fields for Source and Destination Prefix Flows UINT32 flows UINT32 dpkts UINT32 doctets UINT32 First UINT32 Last ipaddrtype src_prefix ipaddrtype dst_prefix UINT8 dst_mask UINT8 src_mask UINT16 reserved UINT16 src_as UINT16 dst_as UINT16 input UINT16 output Number of flows Packets sent in Duration Octets sent in Duration SysUptime at start of flow SysUptime of last packet of flow Source prefix Destination prefix Destination address prefix mask bits Source address prefix mask bits Reserved for future use Originating AS of source address Originating AS of destination address Input interface index Output interface index Configuring a 9300 series Routing Switch for NetFlow To configure NetFlow: Enable individual interfaces for Flow Switching. Flows are collected and exported only for the interfaces on which you enable Flow Switching. Enable NetFlow globally. Specify collector information. The collector is the device to which you are exporting the NetFlow data. You can use up to 10 collectors. NOTE: If you plan to use aggregate caches instead, you do not need to globally enable NetFlow or specify collector information. Instead, you perform this configuration as part of the aggregate cache configuration. The following configuration tasks are optional. Change the maximum number of main cache entries. Specify the interface that will source the exported data. By default, the source interface is the one that is attached through the network to the collector. You can specify an Ethernet port, loopback interface, or null interface as the source for NetFlow export packets. Disable export for specific transport protocols. Change the NetFlow version for export packets from the main cache. You can specify 1 or 5. The default is 5. June 2005 A - 15

16 Advanced Configuration and Management Guide for ProCurve 9300/9400 Series Routing Switches Enable collection of AS information. AS information collection is disabled by default. Set the cache timeout. Configure aggregate caches. Enabling Flow Switching on an Interface NetFlow exports flow data only for the interfaces on which you enable Flow Switching. You can enable Flow Switching on the following types of interfaces: Ethernet interfaces Virtual routing interfaces (flows are collected and exported for all the ports in the VLAN on which the virtual interface is configured) To enable Flow Switching on an interface, enter commands such as the following: ProCurveRS(config)# interface ethernet 1/1 ProCurveRS(config-if-1/1)# ip route-cache flow ProCurveRS(config-if-1/1)# exit Syntax: [no] ip route-cache flow Enabling NetFlow To enable NetFlow, enter the following command at the global CONFIG level of the CLI: ProCurveRS(config)# ip flow-export enable Syntax: [no] ip flow-export enable NOTE: This command enables the feature globally. However, to begin flow collection and export, you must enable collection for individual interfaces. NetFlow collects and exports flows only for the interfaces on which you enable the feature. Changing the Export Format Version By default, NetFlow uses format version 5 for exporting flows from the main cache to the external collector. To change the format version, enter a command such as the following at the global CONFIG level of the CLI: ProCurveRS(config)# ip flow-export version 1 Syntax: [no] ip flow-export version 1 5 For information about the format versions, see Aggregate Caches on page A-9. NOTE: The format for the main cache is not related to the format for aggregate caches. The software automatically uses format 8 for export packets from the aggregate caches. Specifying the Collector NetFlow exports flows to external collectors. You can specify up to 10 collectors for the main flow cache. If you specify more than one collector, NetFlow load balances the exported flows among the collectors based on the source IP addresses in the flows. NOTE: To specify the collector for an aggregate cache, see Configuring Aggregation on page A-20. You must specify an aggregate cache s collector separately, as part of the configuration for the aggregate cache. To specify a collector, enter a command such as the following at the global CONFIG level of the CLI: ProCurveRS(config)# ip flow-export destination Syntax: [no] ip flow-export destination <ip-addr> <udp-portnum> [<collector-id>] A - 16 June 2005

17 Remote Network Monitoring The <ip-addr> parameter specifies the IP address of the collector. The <udp-portnum> specifies the UDP port on the collector that listens for the exported flow packets. The <collector-id> is a number from This number applies only to the HP device and is not related to configuration information on the collector itself. If you are specifying more than one collector, make sure you also specify the collector ID and use a different ID for each collector. If you are specifying only one collector, you do not need to specify the ID. In this case, the software automatically assigns ID 1 to the collector. NOTE: If you do not specify the collector ID, the software always uses ID 1. If you already have added a collector whose ID is 1, and you add another collector with ID 1, the software replaces the older collector with the new collector. Changing the Size of the Main Flow Caches The main flow cache use the Layer 4 session tables on the VM and the TSPs. These tables have a configurable maximum number of flows they can contain. The T-Flow has a separate Layer 4 session table on the VM and on each TSP CPU. VM Layer 4 session table This table contains entries for broadcast traffic, multicast traffic, and for traffic addressed to the HP device itself. TSP CPU session tables The session table on a given TSP CPU contains entries for traffic that is forwarded on that module. You must change the maximum flow cache sizes separately for the VM and for the TSP CPUs. For information about how the forwarding modules are allocated to the TSP CPUs, see the Using the T-Flow Module chapter in the Installation and Basic Configuration Guide for ProCurve 9300 Series Routing Switches. NOTE: Other features including ACLs, rate limiting, Policy-based Routing (PBR) and Network Address Translation (NAT) also use the Layer 4 session table. If you change the session table size, the change can affect all these features. NOTE: If you change the maximum number of Layer 4 session entries, you must reload the software to place the change into effect. Displaying and Changing the Layer 4 Session Table Size on the VM To display the maximum number of flows the Layer 4 session table on the VM can contain, enter the following command at any level of the CLI: ProCurveRS# show default values...<some lines omitted> System Parameters Default Maximum Current...<some lines omitted> session-limit The session-limit row in the System Parameters section shows the default maximum number of Layer 4 sessions (main cache flows) the VM can have, the maximum currently allowed by the VM, and the maximum you can configure the VM to allow. To change the maximum number of Layer 4 sessions on the VM, enter a command such as the following at the global CONFIG level of the CLI: June 2005 A - 17

18 Advanced Configuration and Management Guide for ProCurve 9300/9400 Series Routing Switches ProCurveRS(config)# system-max session-limit Syntax: [no] system-max session-limit <num> The <num> parameter indicates the maximum number of Layer 4 sessions (main cache flows) the VM can have. You can specify from The default is You must reload the software to place the change into effect. Enter the following commands to reload the software. ProCurveRS(config)# exit ProCurveRS# reload NOTE: If you plan to also change the size of the TSP Layer 4 session tables now, you can make that change too before reloading the software to place both changes into effect. Displaying and Changing the Layer 4 Session Table Size on a TSP To display the maximum number of flows the Layer 4 session table on a TSP can contain, log on to the TSP, then enter the show usage command. Here is an example: ProCurveRS# rconsole 2 1 ProCurveRS2/1 # show usage Avail. Sessions = Total Sessions = ProCurveRS2/1 # rconsole-exit ProCurveRS# Syntax: show usage This example shows how to log on to a TSP, display the session table size information, and log off the TSP. To change the maximum number of Layer 4 sessions on each of the TSPs, enter a command such as the following at the global CONFIG level of the CLI: ProCurveRS(config)# server session-vm-limit Syntax: [no] server session-vm-limit <num> The <num> parameter indicates the maximum number of Layer 4 sessions (main cache flows) the VM can have. You can specify from (five million). The default is (two million). The command applies to all the TSPs. You must reload the software to place the change into effect. Enter the following commands to reload the software. ProCurveRS(config)# exit ProCurveRS# reload Setting the Source Interface By default, the HP device uses the port that is connected to a collector as the source interface for flows exported to that collector. You can specify an Ethernet port, a loopback interface, or the null interface as the source for NetFlow export packets. Ethernet NetFlow sends the export packets out the specified interface. Loopback interface NetFlow sends the export packets from the specified loopback address, using a physical port connected to the collector to transmit the packet. Null interface NetFlow continues to collect flows but does not export them to the collector. Use this type of interface when you want to administratively stop flow export without stopping flow collection and without A - 18 June 2005

19 Remote Network Monitoring removing configuration information. To specify the source interface, enter a command such as the following: ProCurveRS(config)# ip flow-export source ethernet 1/1 This command configures port 1/1 to be the source interface for NetFlow packets. Since the command does not specify the collector ID, NetFlow exports the flows to collector 1. To specify the collector ID, enter a command such as the following: ProCurveRS(config)# ip flow-export source ethernet 1/1 2 This command uses port 1/1 as the source for flows exported to collector 2. Syntax: [no] ip flow-export source ethernet loopback <portnum> [<collector-id>] Syntax: [no] ip flow-export source null [<collector-id>] The ethernet loopback <portnum> specifies a physical port or loopback interface. The null parameter discards the export packets instead of sending them to a collector. However, NetFlow continues to collect flows. The <collector-id> specifies the collector. If you do not specify the collector ID, the device assumes you mean collector 1. Disabling Export of Flows for Some Transport Protocols By default, NetFlow exports flows for all IP protocols (TCP, UDP, IGRP, OSPF, and so on). To reduce flow exports to the collectors, you can disable export of flows for the following: TCP UDP All IP protocols except TCP and UDP To disable export of flows, enter a command such as the following: ProCurveRS(config)# ip flow-export protocol-disable udp Syntax: [no] ip flow-export protocol-disable tcp udp other Enabling AS Flow Information Export version format 8 contains fields for BGP4 AS information. By default, NetFlow does not collect and export the AS information. To enable collection and export of the AS information, enter the following command at the global CONFIG level of the CLI: ProCurveRS(config)# ip flow-export peer-as Syntax: [no] ip flow-export origin-as peer-as The origin-as peer-as parameter specifies the type of AS information you want to enable. You can enable one or the other but not both. By default, neither type of AS information is enabled. Changing the Cache Timeouts NetFlow uses the following age timers to age flows out of the cache for export. Inactive The inactive timer ages out a flow after it has been unused for the specified number of seconds. Active The active timer ages out a flow that is in use if the flow has remained in use continuously for the specified number of minutes. NOTE: In addition to using these timers, NetFlow also ages out normally terminated TCP flows, and ages out flows when the cache becomes full. See Flow Aging and Export on page A-9. June 2005 A - 19

20 Advanced Configuration and Management Guide for ProCurve 9300/9400 Series Routing Switches NOTE: The main flow cache and the aggregate caches (if you configure them) use separate timeouts. Changing the main flow cache s timeouts does not affect the timeouts for the aggregate caches. To change a flow aging timer, enter a command such as the following at the global CONFIG level of the CLI: ProCurveRS(config)# ip flow-cache timeout active 45 This command changes the maximum age for active flows to 45 minutes. Syntax: [no] ip flow-cache timeout active <mins> inactive <secs> The active <mins> parameter specifies the maximum number of minutes an active flow can remain in the cache. The inactive <secs> parameter specifies the maximum number of seconds an inactive flow can remain in the cache. Configuring Aggregation By default, NetFlow exports a separate flow for each unique set of flow information. You can consolidate flows by creating aggregate caches. An aggregate cache consolidates individual flows based on specific information in the flows. You can configure the following types of aggregate caches: BGP4 AS information Source and destination network prefixes Source network prefix Destination network prefix IP protocol and application port number See Aggregate Caches on page A-9 for a list of the flow data fields that are aggregated in each type of aggregate cache. Each cache requires separate configuration. When you configure an aggregate cache, you can configure the following parameters: Collector IP address and UDP port Maximum number of flows Inactive timeout Active timeout Each aggregate cache has its own settings for these parameters. The parameters are independent from the parameters for the main flow cache. The settings for the main flow cache do not affect the settings for similar parameters in the aggregate caches. NOTE: NetFlow automatically uses export format version 8 for export packets from an aggregate cache. The format for aggregate flows is unrelated to the format for export packets from the main cache. You do not need to configure the export format for the aggregate caches. Configuring an Aggregate Cache To begin configuration of an aggregate cache, enter a command such as the following at the global CONFIG level of the CLI: ProCurveRS(config)# ip flow-aggregation cache as ProCurveRS(config-flow-cache_as)# A - 20 June 2005

21 Remote Network Monitoring This command begins configuration for the AS aggregate cache. Notice that the CLI prompt changes to the configuration level for the aggregate cache. At the aggregate cache s configuration level, you can change cache parameters. Here is an example: ProCurveRS(config)# ip flow-aggregation cache as ProCurveRS(config-flow-cache_as)# cache entries 2046 ProCurveRS(config-flow-cache_as)# cache timeout inactive 200 ProCurveRS(config-flow-cache_as)# cache timeout active 45 ProCurveRS(config-flow-cache_as)# export destination ProCurveRS(config-flow-cache_as)# enabled The cache commands change cache parameters. The enable command enables the cache. A cache does not go into effect until you enable it. Command Syntax The following command begins configuration of an aggregate cache. Syntax: [no] ip flow-aggregation cache as destination-prefix prefix protocol-port source-prefix The as destination-prefix prefix protocol-port source-prefix parameter specifies the cache type. as Configures an AS cache. Flows are aggregated based on AS number. destination-prefix Configures a destination prefix cache. Flows are aggregated based on destination network prefix. prefix Configures a prefix cache. Flows are aggregated based on both source and destination network prefixes. protocol-port Configures a protocol port cache. Flows are aggregated based on source and destination IP protocol port. source-prefix Configures a source prefix cache. Flows are aggregated based on source network prefix. The following command specifies the collector. You can specify one collector for an aggregate cache. Syntax: [no] export destination <ip-addr> <udp-portnum> The following command specifies the maximum number of flows the cache can contain. Syntax: [no] cache entries <num> The <num> parameter specifies the maximum number of flows and can be from The default is The following commands specify the active and inactive timeouts. Syntax: [no] cache timeout inactive <secs> Syntax: [no] cache timeout active <mins> The inactive <secs> parameter specifies the maximum number of seconds an inactive flow can remain in the cache. The active <mins> parameter specifies the maximum number of minutes an active flow can remain in the cache. The following command enables the cache. Syntax: [no] enabled NOTE: The enabled command is required to enable the cache. The cache commands are optional. Displaying NetFlow Information You can display the following information: Export configuration information and statistics June 2005 A - 21

22 Advanced Configuration and Management Guide for ProCurve 9300/9400 Series Routing Switches Flow cache configuration information and the flows in the caches NOTE: The CLI has different commands for displaying the VM flow cache and a TSP s flow cache. Statistics for aggregate caches Displaying Export Information To display configuration information and statistics for NetFlow export, enter the following command at any level of the CLI: ProCurveRS(config)# show ip flow export Flow export is enabled Version 5 flow records Autonomous System information not included in export datagrams COLLECTOR 1: Exporting using source interface Ethernet 3/1 Collector IP address Collector UDP port 3065 COLLECTOR 2: Exporting using source interface Ethernet 3/2 Collector IP address Collector UDP port 3066 COLLECTOR 3: Exporting using source interface Ethernet 3/3 Collector IP address Collector UDP port 3000 Cache for protocol-port aggregation: Aggregation flow export is enabled Exporting using source interface Ethernet 3/5 Exporting flows to (3233) Cache for destination-prefix aggregation: Aggregation flow export is enabled Exporting using source interface Ethernet 3/4 Exporting flows to (3235) flows exported in udp datagrams 0 flows failed to export 0 export packets were dropped Syntax: show ip flow export A - 22 June 2005

23 Remote Network Monitoring This command shows the following information. Table A.5: Export Configuration and Statistics This Line... Displays... Main flow cache information Flow export Version Autonomous system information COLLECTOR The state of the feature, which can be one of the following: disabled enabled The version of the flow UDP packets sent to the collector. The version can be one of the following: 1 5 (the default) If peer AS or origin AS information is included in the flows, this is indicated by "peer-as" or "origin-as" following the version information. Whether you have enabled collection of AS information. The collectors you have configured for exports from the main flow cache. The non-aggregated flows go to these collectors. The following information is listed for each collector: Source interface Collector IP address Collector UDP port Aggregate cache information Cache type Cache state Source interface Collector The aggregate cache type. Whether the cache is enabled or disabled. The source interface for exporting flows from the cache. The IP address and UDP port of the collector. Export statistics Note: These fields apply to the flows exported from the main cache and from the aggregate caches. Flows exported Flows failed to export Export packets dropped The number of flows exported to the collector and the number of UDP datagrams used to send the flows. The number of flows that could not be exported. This can occur if the collector is not reachable. The number of flows that were dropped rather than sent to the collector. This can occur if too many flows are expiring (becoming eligible for export) at the same time and there is not enough buffer to hold all of them. June 2005 A - 23