NETFLOW-MIB

MIB Reference — IPNetwork Monitor

All MIBsNETFLOW-MIB

Organization: BDCOM Systems, Inc.

Last Updated: 2012-03-19

Category: Traffic Shaping

Description:

Monitors NetFlow traffic accounting data including flow records, export statistics, and cache utilization on BDCOM devices.

Imported Objects

From BDCOM-SMI

bdMgmtOBJECT-IDENTITY

From IF-MIB

ifIndexOBJECT-TYPE

From INET-ADDRESS-MIB

InetAddress
InetAddressType
InetPortNumber

From NMS-SMI

nmsMgmtOBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Gauge32
Integer32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

RowStatus
TEXTUAL-CONVENTION
TruthValue

What Is NETFLOW-MIB?

This NETFLOW-MIB is a BDCOM enterprise MIB exposing NetFlow traffic-accounting functionality over SNMP, providing a simple way to retrieve NetFlow cache contents, configuration, and export statistics without a dedicated collector. It belongs to the traffic-monitoring/flow-accounting technology area and covers per-interface NetFlow enablement, cache configuration/statistics (entries, used/unused entries, active/inactive timeouts), and collector/export configuration and statistics. For monitoring device software status it reveals whether NetFlow is enabled on a given interface, how full the flow cache is (indicating whether it is being exhausted under high traffic load), and whether exported flow records are reaching the configured collector. It is a self-contained BDCOM enterprise MIB that mirrors Cisco's NetFlow model conceptually rather than importing a standard NetFlow/IPFIX MIB. It is typically deployed on BDCOM carrier-class or metro Ethernet switches/routers used for traffic accounting and network visibility. Network engineers evaluating or troubleshooting this functionality can download the NETFLOW-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in NETFLOW-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

What Can Be Monitored

  • per-interface NetFlow enable status
  • flow cache entries used vs. available
  • active/inactive flow timeout settings
  • NetFlow collector configuration
  • flow export statistics

Supported Devices

  • BDCOM carrier/metro Ethernet switch or router

Monitoring Examples

An operator checks netflowInterfaceTable/netflowInterfaceEntry to confirm netflowCacheNetflowEnable is set on the interfaces expected to export flow data, then polls netflowCacheTable/netflowCacheEntry for netflowCacheEntries, netflowUsedEntries, and netflowUnUsedEntries to see how full the flow cache is — a netflowUsedEntries value close to netflowCacheEntries signals the cache is near capacity. Reviewing netflowActiveTimeOut and netflowInactiveTimeOut confirms how aggressively flows are aged out, and the netflowCollectorInfo branch is checked to verify the configured NetFlow collector is receiving exports.

OIDs
OID symbolicOID numericTypeAccessDescription
netflowMIB1.3.6.1.4.1.3320.9.226The Netflow MIB provides a simple and easy method to get NetFlow cache information, current NetFlow configuration and statistics. It will enable medium to small size enterprises to take advantage of NetFlow technology over SNMP at a reduced infrastructure cost. The MIB is created to provide Netflow information in these areas: 1. Cache information and configuration. 2. Collector information and configuration. 3. Export Statistics. 4. Version 9 Export Template information. Terminology used Flow A flow is defined as a unidirectional sequence of packets with some common properties that pass through a network device. These collected flows are exported to an external device, the NetFlow collector. Network flows are highly granular; for example, flow records include details such as IP addresses, packet and byte counts,timestamps, Type of Service (ToS), application ports, input and output interfaces, etc. Exporter A device (for example, a router) with NetFlow services enabled. The exporter monitors packets entering an observation point and creates flows out of these packets. The information from these flows are exported in the form of Flow Records to the collector. Flow Record A Flow Record provides information about an IP Flow that exists on the Exporter. The Flow Records are commonly referred to as NetFlow Services data or NetFlow data. Collector The NetFlow Collector receives Flow Records from one or more Exporters. It processes the received export packet, i.e. parses, stores, display the Flow Record information. The flow records may be optionally aggregated before being stored into the hard disk. Template NetFlow Version 9 Export format is template based. Version 9 record format consists of a packet header followed by at least one or more template or data FlowSets. A template FlowSet (collection of one or more template) provides a description of the fields that will be present in future data FlowSets. Templates provide an extensible design to the record format, a feature that should allow future enhancements to NetFlow services without requiring concurrent changes to the basic flow-record format. One additional record type is also a part of Version 9 specification: an options template. Rather than supplying information about IP flows, options are used to supply information about the NetFlow process configuration or NetFlow process specific data.
netflowMIBObjects1.3.6.1.4.1.3320.9.226.1
netflowCacheInfo1.3.6.1.4.1.3320.9.226.1.1
netflowInterfaceTable1.3.6.1.4.1.3320.9.226.1.1.1not-accessibleThis table provides Netflow Enable information per interface.
netflowInterfaceEntry1.3.6.1.4.1.3320.9.226.1.1.1.1not-accessibleA conceptual row in the netflowInterfaceEntry.
NUM netflowCacheNetflowEnable1.3.6.1.4.1.3320.9.226.1.1.1.1.1NetflowInterfaceDirectionTypesread-writeIndicates whether the netflow feature is enabled for this interface, and if so, in which directions.
netflowCacheTable1.3.6.1.4.1.3320.9.226.1.1.2not-accessibleA table containing configuration and statistics per cache. Cache may be main cache or an aggregation cache.
netflowCacheEntry1.3.6.1.4.1.3320.9.226.1.1.2.1not-accessibleA conceptual row in the netflowCacheEntry.
NET netflowCacheType1.3.6.1.4.1.3320.9.226.1.1.2.1.1NetflowAggregationtypesnot-accessibleThe type of netflow cache. NetFlow aggregation maintains one or more extra flow caches with different combinations of fields that determine which traditional flows are grouped together.
T/F netflowCacheEnable1.3.6.1.4.1.3320.9.226.1.1.2.1.2TruthValueread-onlyIndicates whether netflow is enabled for this cache type.
U32 netflowCacheEntries1.3.6.1.4.1.3320.9.226.1.1.2.1.3Unsigned32read-onlyThe number of entries that can be cached for this cache type. The accepted value could be limited based on the amount of memory available in the system.
U32 netflowUsedEntries1.3.6.1.4.1.3320.9.226.1.1.2.1.4Unsigned32read-onlyNumber of currently used flow entries.
U32 netflowUnUsedEntries1.3.6.1.4.1.3320.9.226.1.1.2.1.5Unsigned32read-onlyNumber of currently available flow entries.
U32 netflowActiveTimeOut1.3.6.1.4.1.3320.9.226.1.1.2.1.6Unsigned32read-onlyThe timeout period (in minutes) for removing active flows from the cache.
U32 netflowInactiveTimeOut1.3.6.1.4.1.3320.9.226.1.1.2.1.7Unsigned32read-writeThe timeout period (in seconds) for removing inactive flows from the cache.
netflowCollectorInfo1.3.6.1.4.1.3320.9.226.1.2
netflowCollectorVersionInfoTable1.3.6.1.4.1.3320.9.226.1.2.1not-accessibleA table containing version information about export configuration per cache type.
netflowCollectorVersionInfoEntry1.3.6.1.4.1.3320.9.226.1.2.1.1not-accessibleA conceptual row in the netflowCollectorInfoEntry.
NET netflowExportVersion1.3.6.1.4.1.3320.9.226.1.2.1.1.1NetflowVersionTyperead-writeThe NetFlow data export version.
U32 netflowMaxCollectors1.3.6.1.4.1.3320.9.226.1.2.2Unsigned32read-onlyMaximum number of entries allowed in the netflowCollectorTable for each cache type. A zero indicates export is not supported in the device. The agent should set this value during initialization, and the value for this object cannot be changed during the system's operation.
netflowCollectorTable1.3.6.1.4.1.3320.9.226.1.2.3not-accessibleA control table to configure the collectors that the netflow packets are exported to. The number of entries that can be configured for the cache type is limited by the value of netflowMaxCollectors.
netflowCollectorEntry1.3.6.1.4.1.3320.9.226.1.2.3.1not-accessibleA conceptual row in the netflowCollectorEntry.
IPt netflowCollectorAddressType1.3.6.1.4.1.3320.9.226.1.2.3.1.1InetAddressTyperead-onlyThe type of Internet address used by this entry.
IP netflowCollectorAddress1.3.6.1.4.1.3320.9.226.1.2.3.1.2InetAddressread-writeThe Internet address of the collector. This is the address which the Netflow data is exported to.
INE netflowCollectorPort1.3.6.1.4.1.3320.9.226.1.2.3.1.3InetPortNumberread-writeThe transport port of the collector which the Netflow data is exported to.
ROW netflowCollectorStatus1.3.6.1.4.1.3320.9.226.1.2.3.1.4RowStatusread-createThis object is used to create or delete an entry in the netflowCollectorTable. * A row may be created using the 'CreateAndGo' or 'CreateAndWait' option. When the row is successfully created, the RowStatus would be set to 'active' by the agent. * A row may be deleted by setting the RowStatus to 'destroy'.
netflowExportStatistics1.3.6.1.4.1.3320.9.226.1.3
C32 netflowOctetsExport1.3.6.1.4.1.3320.9.226.1.3.1Counter32read-onlytotal Number of bytes statistics records which were exported.
C32 netflowRecordsExported1.3.6.1.4.1.3320.9.226.1.3.2Counter32read-onlytotal Number of flow statistics records which were exported.
C32 netflowPktsExported1.3.6.1.4.1.3320.9.226.1.3.3Counter32read-onlyNumber of packets (udp datagrams) which were exported.
C32 netflowPktsFailed1.3.6.1.4.1.3320.9.226.1.3.4Counter32read-onlyNumber of times a flow record failed to be exported.
netflowTemplateInfo1.3.6.1.4.1.3320.9.226.1.4
T/F netflowTemplateOptionsFlag1.3.6.1.4.1.3320.9.226.1.4.1TruthValueread-writeindicate that it has option template.
netflowTemplateTable1.3.6.1.4.1.3320.9.226.1.4.2not-accessibleA control table to provide statistics of version 9 Flow and Option templates.
netflowTemplateEntry1.3.6.1.4.1.3320.9.226.1.4.2.1not-accessibleA conceptual row in the netflowTemplateEntry.
NET netflowTemplateType1.3.6.1.4.1.3320.9.226.1.4.2.1.1NetflowTemplateTypesnot-accessibleDefines the structure and interpretation of fields in a data record and serves as an INDEX in this table. Version 9 has two types of Templates: Flow Templates and Option Templates.
U32 netflowTemplateAdded1.3.6.1.4.1.3320.9.226.1.4.2.1.2Unsigned32read-onlyNumber of templates added.
U32 netflowTemplateActive1.3.6.1.4.1.3320.9.226.1.4.2.1.3Unsigned32read-onlyNumber of active templates.
U32 netflowTemplateAgerPolls1.3.6.1.4.1.3320.9.226.1.4.2.1.4Unsigned32read-onlyNumber of template ager polls.
netflowTemplateExportInfoTable1.3.6.1.4.1.3320.9.226.1.4.3not-accessibleA control table providing information about version 9.
netflowTemplateExportInfoEntry1.3.6.1.4.1.3320.9.226.1.4.3.1not-accessibleA conceptual row in the netflowTemplateExportInfoEntry.
T/F netflowTemplateExportVer9Enable1.3.6.1.4.1.3320.9.226.1.4.3.1.1TruthValueread-onlyObject to indicate whether version 9 export is configured or not.
U32 netflowTemplateExportVer9TplTimeout1.3.6.1.4.1.3320.9.226.1.4.3.1.2Unsigned32read-writeExport template time out. Templates are resent after this time.
U32 netflowTemplateExportVer9OptTimeout1.3.6.1.4.1.3320.9.226.1.4.3.1.3Unsigned32read-writeExport option time out. Options are resent after this time.
U32 netflowTemplateExportVer9TplRefreshRate1.3.6.1.4.1.3320.9.226.1.4.3.1.4Unsigned32read-writeTemplate refresh rate. Templates are resent after this many packets.
U32 netflowTemplateExportVer9OptRefreshRate1.3.6.1.4.1.3320.9.226.1.4.3.1.5Unsigned32read-writeOption refresh rate. Options are resent after this many packets.

RFC description

NetFlow traffic monitoring providing cache configuration, collector settings, export statistics, and flow analytics.

Start monitoring BDCOM carrier/metro Ethernet switch or router (NetFlow traffic accounting) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download NETFLOW-MIB