SNMP Operations with the NETFLOW-MIB

The CISCO-NETFLOW-MIB MIB, supported on the Cisco routers, provides real-time access to a limited number of fields in the flow cache. Exporting the entire cache via SNMP is not technically feasible in many cases, because a flow cache may fill up to 64 MB. Therefore, the MIB does not allow the retrieval from the entire cache content.

The NetFlow MIB defines managed objects that enable a network administrator to do the following:

• Configure the number of cache entries, both on the main cache and on the aggregation caches

• Configure the cache timeout values, both on the main cache and on the aggregation caches

• Configure NetFlow export parameters on the main and aggregation caches: NetFlow version, NetFlow Collector IP address and port number, export protocol, BGP Autonomous System, BGP next hop, etc.

• Configure NetFlow on physical and logical (sub)interfaces

• Configure the source and destination minimum mask for the aggregation caches

• Configure NetFlow version 9 specific details, such as template options, etc.

• Monitor the NetFlow cache statistics per protocol and port

• Monitor the NetFlow export statistics

Also included with the NetFlow MIB is the Top Talkers feature to display the Top-N flows in the NetFlow cache. The NetFlow MIB and Top Talkers feature provide information about traffic patterns and application usage in the network. The Top Talkers feature can be configured for the Top-N flows to appear sorted in a dedicated new cache. The NetFlow MIB allows the retrieval of the information elements for the Top-N flows. The CISCO-SWITCH-ENGINE-MIB, which is specific for the Catalyst 6500/Cisco 7600, offers a couple of interesting MIB variables to monitor the MLS table:

• cseCacheUtilization monitors the flow utilization level in percent.

• cseL3ActiveFlows monitors the number of active flows in the Layer 3 flow table.

• cseL3FlowLearnFailures monitors the number of flows that failed to be learned because the Layer 3 flow table was full.