---
title: "Setting up data collection from SNMP MIBs."
canonical: "https://thoughtdata.refined.site/space/TUD/55643377/Setting%20up%20data%20collection%20from%20SNMP%20MIBs."
format: markdown
---
## Setting up Netflow data collection on various network devices

**Pre-Requisite**: Basic knowledge of Netflow is required to understand this topic and setting up your Netsense to collect netflow data from different network devices. This is typically done by network admins and advanced users in IT network. 

<span style="color: #000000">Setting up proper Netflow configuration on routers, switches and firewalls is typically done by network administrators in an IT network. Proper Netflow export configuration on routers, switches and firewalls is essential to do Netflow based traffic monitoring in ThoughtData's Enterprise360. </span>

<span style="color: #000000">Various versions of Netflow include </span>

- <span style="color: #000000">version 5</span>
- <span style="color: #000000">version 7</span>
- <span style="color: #000000">version 9</span>
- <span style="color: #000000">IPFIX</span>
- <span style="color: #000000">CFlow</span>
- <span style="color: #000000">SFlow,</span>
- <span style="color: #000000">JFlow formats.</span>

<span style="color: #000000">Netflow export data format can also widely vary across different device vendors/OEMs. </span>

**<span style="color: #000000">Note</span>**<span style="color: #000000">: </span><span style="color: #000000">*Providing illustrations for Netflow configuration for various versions or vendors or OEMS is out of scope of this documentation. Enterprise360 users are encouraged to read the respective OEM/vendor manuals/guides in performing the right Netflow export configuration on their respective routers, switches and firewalls.*</span>

<span style="color: #000000">During the configuration of Netflow export on routers, switches and firewalls. Users need to configure a export destination IP address. Enterprise360 users should provide Netsense Netflow collector's IP as the destination of their intended Netflow data export.The default export port number which has to be configured for </span>

<span style="color: #000000">Netsense Netflow collector shall be port number </span>**<span style="color: #000000">9992</span>**<span style="color: #000000">.</span>

<span style="color: #000000">A example illustration of Cisco based V9 netflow export configuration on a typical switch is provided below</span>

<span style="color: #000000">Netflow export on Cisco based networking devices typically follow these steps</span>

<span style="color: #000000">Create a Netflow flow record in input and output direction.</span>

<span style="color: #000000">Create a flow monitor</span>

<span style="color: #000000">Associate a flow </span><span style="color: #000000">record to a flow monitor.</span>

<span style="color: #000000">Create a netflow export record.</span>

<span style="color: #000000">Associate the export destination IP address and port number information in the export record.</span>

<span style="color: #000000">Associate the Netflow Flow monitor to specific ports of the router, switch or firewall on which netflow export is required</span>

Detailed Steps below (applicable only to Cisco switches)

1. Configure the Input Flow Record

You can create a flow record and add keys to match on and fields to collect in the flow.

`config terminal
flow record {NetSensenputRecord}
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match ipv4 protocol
match interface input
match ipv4 tos
match flow direction
collect interface output
collect counter bytes long
collect counter packets long
collect transport tcp flags
collect timestamp absolute first
collect timestamp absolute last`

 

2. Configure the Output Flow Record

`flow record {NetSenseOutputRecord}
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match ipv4 protocol
match interface output
match ipv4 tos
match flow direction
collect interface input
collect counter bytes long
collect counter packets long
collect transport tcp flags
collect timestamp absolute first
collect timestamp absolute last`

 

3. Configure the Flow Exporter

You can create a flow export to define the export parameters for a flow.

Each flow exporter supports only one destination. If you want to export the data to multiple destinations, you must configure multiple flow exporters and assign them to the flow monitor.

Set the destination to the IP address of your Netsense Netflow Collector.

`flow exporter {ExporterName}
destination {NetSenseCollectorIP}
source {ManagementInterfaceName}
transport udp 9992
template data timeout 60`

 

4. Configure the Input and Output Flow Monitor

You can create a flow monitor and associate it with a flow record and a flow exporter.

`flow monitor {NetSenseInputMonitor}
exporter {ExporterName}
record {NetSenseInputRecord}
cache timeout active 60
flow monitor {NetSenseOutputMonitor}
exporter {ExporterName}
record {NetSenseOutputRecord}
cache timeout active 60`

 

4. Enabling Flow on an Interface

Enter global configuration mode on the Cisco Switch, and issue the following commands for each interface on which you want to enable flow:

`interface {InterfaceName}
ip flow monitor {NetSenseInputMonitor} input
ip flow monitor {NetSenseOutputMonitor} output`

 

5. Save the configuration

`copy running-config startup-config`

 

<span style="color: #000000">Refer to respective to vendor/OEM guides for more information on how to enable and export Netflow flow records successfully to target the export to ThoughtData's Netsense Netflow collector.</span>

<span style="color: #000000">Troubleshooting Netflow data collection on Netsense Netflow Collector.</span>

- <span style="color: #000000">If you are successfully exporting Netflow from your router, switch and firewall. On to Netsense Netflow collector you may test your Netflow export by running following command</span>
- <span style="color: #000000">tcpdump port 9992.</span>
- <span style="color: #000000">If the output off this command shows Netflow packets from your intended Netflow router, switch or firewall from where you have initiated the netflow export. Then you can presume your Netflow export is being properly setup to ThoughtData's Netsense Netflow collector</span>
- <span style="color: #000000">If you do not see netflow packets in the above command, you might want to cross check the Netflow configuration on your respective router, switch or firewall until you get the proper Netflow packets in output of the command above</span>