We can use Python to parse the NetFlow datagram being transported on the wire. This gives us a way to look at the NetFlow packet in detail as well as troubleshoot any NetFlow issue when they are not working as expected.
First, let's generate some traffic between the client and server across the VIRL network. We can use the built-in HTTP server module from Python to quickly launch a simple HTTP server on the VIRL host acting as the server:
cisco@Server:~$ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 ...
We can create a short loop to continuously send HTTP GET to the web server on the client:
sudo apt-get install python-pip python3-pip
sudo pip install requests
sudo pip3 install requests
$ cat http_get.py
import requests, time
while True:
r = requests.get('http://10.0.0.5:8000')
print(r.text)
time.sleep(5)
The client should get a very plain HTML page:
cisco@Client:~$ python3 http_get.py
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"><html>
<title>Directory listing for /</title>
<body>
...
</body>
</html>
We should also see the requests continuously coming in from the client every 5 seconds:
cisco@Server:~$ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 ...
10.0.0.9 - - [15/Mar/2017 08:28:29] "GET / HTTP/1.1" 200 -
10.0.0.9 - - [15/Mar/2017 08:28:34] "GET / HTTP/1.1" 200 -
We can export NetFlow from any of the devices, but since r6-edge is the first hop for the client host, we will have this host export NetFlow to the management host at port 9995.
!
ip flow-export version 5
ip flow-export destination 172.16.1.173 9995 vrf Mgmt-intf
!
interface GigabitEthernet0/4
description to Client
ip address 10.0.0.10 255.255.255.252
ip flow ingress
ip flow egress
...
!
Next, let's take a look at the Python parser script.