Cisco Catalyst 2960 Series

Configuring Layer 2 NetFlow
You can define Layer 2 keys in NetFlow Lite records that you can use to capture flows in Layer 2 interfaces.
SUMMARY STEPS
1.
configure terminal
2.
flow record name
3.
match datalink { ethertype | mac { destination { address input } | source { address input } } }
4.
match { ipv4 {destination | protocol | source | tos } | ipv6 {destination | flow-label| protocol| source|
traffic-class } | transport {destination-port | source-port} }
5.
end
6.
show flow record [name ]
7.
copy running-config startup-config
DETAILED STEPS
PurposeCommand or Action
Enters the global configuration mode.configure terminal
Example:
Switch# configure terminal
Step 1
Enters flow record configuration mode.
flow record name
Step 2
Example:
Switch(config)# flow record L2_record
Switch(config-flow-record)#
Specifies the Layer 2 attribute as a key. In this
example, the keys are the source and destination MAC
addresses from the packet at input.
match datalink { ethertype | mac { destination { address
input } | source { address input } } }
Example:
Switch(config-flow-record)# match datalink mac source
Step 3
When a datalink flow monitor is assigned to
an interface or VLAN record, it only creates
flows for non-IPv4 or non-IPv6 traffic.
Note
address input
Switch(config-flow-record)# match datalink mac
destination address input
Specifies additional Layer 2 attributes as a key. In this
example, the keys are IPv4 protocol and ToS.
match { ipv4 {destination | protocol | source | tos } | ipv6
{destination | flow-label| protocol| source| traffic-class } |
transport {destination-port | source-port} }
Step 4
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
532
How to Configure NetFlow Lite