Filtering of Traffic Flows
In the context of vFlows, filtering describes the traffic characteristics on which the network administrator intends to undertake a certain action. You can define the filter through one of the arbitrary set of matching qualifiers as illustrated in Figure 12-5 and Figure 12-6:
- Operating at an OSI or Internet Protocol layer, which is based on the packet header content
- Based on NetVisor OS logical constructs, such as vNET, vFlow metadata, or vRouter.
Figure 12-5: vFlow Filtering Using Packet Header Fields and NetVisor Logical Constructs
Figure 12-6: vFlow Tables - Packet Forwarding Stage and Filter or Action Capabilities
To define the vFlow filter using the components of OSI layer, use the following keywords or parameters in the vflow-create command:
Filtering Qualifiers at Physical Layer
- in-port port-list — ingress physical interface or LAG interface identifiers. NetVisor OS accepts values as a single value, a dash-separated value range, or comma-separated list of values and ranges.
- out-port port-list — egress physical interface or LAG interface identifier. NetVisor OS accepts values as a single value, a dash-separated value range, or comma-separated list of values and ranges. This out-port is applicable for Egress_table.
Filtering Qualifiers at Data Link Layer
- packet-res — packet resolution in the ASIC. The resolution types can be L2-unicast, L2-unknown-unicast, L2 multicast, L2-unknown-multicast, L2-broadcast. For more details, see the Enhancing the vFlow Capability to Match Forwarding Type and Packet Resolution in ASIC section.
- fwding-type — ASIC forwarding type: VLAN, VXLAN, or vLE
- vlan — VLAN (Virtual LAN) identifier (IEEE 802.1q). Range is from 0 through 4095.
- vxlan —VxLAN Network Identifier or VNI
- vxlan-ether-type — Ethernet type such IPv4, ARP, WAKE, RARP, VLAN, IPv6, LACP, MPLS-uni, MPLS-multi, Jumbo, dot1X, AOE, Q-in-Q, LLDP, MACSEC, ECP, PTP, FCOE, FCOE-init, or Q-in-Q-old
- vxlan-proto — Protocol type for the VXLAN. Includes TCP, UDP, ICMP, IGMP, IP, ICMPv6
- src-mac — Source MAC address
- src-mac-mask — Mask for source MAC address
- dst-mac — Destination MAC address for the vFlow
- dst-mac-mask — Mask for destination MAC address
- vlan-pri — Class of Service (CoS) or VLAN priority (IEEE 802.1p), ranges from 0 through 7.
Filtering Qualifiers at Internet Layer
- src-ip — Source IP address for the vFlow
- src-ip-mask — Mask for source IP address
- dst-ip — Destination IP address
- dst-ip-mask — Mask destination IP address
- ttl — Packet time-to-live
- proto — Layer 3 protocol for the vFlow
- dscp — 6-bit Differentiated Services Code Point (DSCP) for Quality of Service (QoS), in the range of 0 to 63
- dscp-start — Start value for DSCP
- dscp-end — End value for DSCP
- tos — Type of Service (ToS) value for Quality of Service (QoS)
- tos-start — Start value for Type of Service (ToS) range
- tos-end — End value for Type of Service (ToS) range
Filtering Qualifiers at Transport Layer
- src-port — Source transport port
- src-port-mask — Mask for source transport port
- src-port-end — Ending port for a range of source ports. Use this qualifier along with src-port to specify a range of ports. This option is mutually exclusive with src-port-mask
- dst-port — Destination transport port
- dst-port-mask — Mask for destination transport port
- dst-port-end — Ending port for a range of destination ports. Use this qualifier along with dst-port to specify a range of ports. This option is mutually exclusive with dst-port-mask
- tcp-flags — Comma-separated list of TCP control flag values
Filtering Qualifiers at User Defined Fields (UDFs)
- udf-name[1-3] — Reference to a User Defined Field (UDF) object, and defines advanced multi-layer filtering. Up to 3 objects are supported.
- udf-data[1-3] — Data value applied to the corresponding UDF object
- udf-data[1-3]-mask — Mask value applied to the corresponding UDF object
For details on configuring vFlows with UDFs, see the Configuring vFlows with user Defined Fields section.
NetVisor OS Logical Filtering
To define the vFlow filter using the NetVisor OS logical constructs, use the following keywords or parameters in the vflow-create command:
- metadata — Metadata tag value assigned to packets along the internal hardware forwarding path, which can be used to correlate different vFlow objects operating at different ingress and egress stages
- bridge-domain — Logical abstraction of data-link learning and forwarding domain, implemented using a combination of physical interfaces, VLANs and VNI
- vrouter-name — Reference to an Internet layer VRF context defined on a local vRouter
- vrf - Parameter used to enable vFlows to operate at scale in a distributed VRF environment.
For details, see the Configuring VRF-aware vFlow section of the Configuring VXLAN chapter.
- vnet — Virtual Network (vNET) value, used for identifying traffic belonging to a logical network partition for multi-tenancy and network segmentation purposes.
- src-vpg, dst-vpg, bidir-vpg-1, bidir-vpg-2 — Source, destination, and bidirectional Virtual Port Groups(vPGs) are logical constructs that allows you to club ports together in order to support the Network Packet Broker solution. For details, see the Configuring Network Packet Broker section of the Configuring Network Management and Monitoring chapter.