Home > NetFlow Questions

NetFlow Questions

January 28th, 2021 Go to comments

Note: If you are not sure about NetFlow, please read our NetFlow tutorial.

Question 1

Explanation

The “mode random one-out of 100” specifies that sampling uses the random mode and only take one sample out of every 100 packets.

Question 2

Explanation

Option A is not correct because “flow FLOW-MONITOR-1” cannot be under “sampler SAMPLER-1”.
Option B is not correct because we remove “mode random 1 out-of 2”.
Option D is not correct because “sampler SAMPLER-1” cannot be put under “flow monitor …”
Option C is correct and the command “ip flow monitor …” assigns the flow monitor and the flow sampler that you created to the interface to enable sampling.

Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fnetflow/configuration/xe-3se/3850/use-fnflow-redce-cpu.html

Question 3

Explanation

To configure multiple NetFlow export destinations to a router, use the following commands in global configuration mode:

Step 1: Router(config)# ip flow-export destination ip-address udp-port
Step 2: Router(config)# ip flow-export destination ip-address udp-port

The following example enables the exporting of information in NetFlow cache entries:

ip flow-export destination 10.42.42.1 9991
ip flow-export destination 10.0.101.254 1999

Reference: https://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/12s_mdnf.html

Question 4

Comments
  1. Nick
    February 5th, 2021

    Q2 is C – only to add an interface config

    D is wrong because there is no subcommand “sampler” under flow monitor command

  2. skate_in_hawaii
    February 9th, 2021

    I agree with Nick. I tried this in IOSv 15.6(2)T and I cannot find the “sampler” subcommand under flow monitor configuration mode either. Can someone check what is best answer here?

  3. LayDbug
    February 10th, 2021

    I agree, I will choose the answer C for Q2. I reviewed the command reference and sampler is configured independent from monitor. Then they are applied together for required interface.
    @digitaltut can you reconsider the answer?

  4. Anonymous
    February 17th, 2021

    Question 2

    Agree answer should be “C” flow monitor and flow sampler are combined on the interface.

  5. Anonymous
    February 17th, 2021

    Q-2 I agree “C” is the correct answer Flow monitor and Flow sampler are combined when being applied on interface.

  6. Razor
    February 28th, 2021

    @Digitaltut Q2? Can you confirm this answer?

  7. zaphod
    March 10th, 2021

    Q2: Answer is C.

  8. ENCOR123
    March 15th, 2021

    option “C” correct if the “record name” is same in the exhibit (defined record name) & (the record name under flow monitor)

    option “D” correct if no sampler command mentioned under flow monitor
    OR
    the sampler command mentioned without indentation in option “D”

    I think make sense!

  9. T-REX
    March 16th, 2021

    Q2: Answer is C
    1. There is no option to add a sampler to the flow monitor.
    2. There is a typo in the name of the flow record that is added to the flow monitor (it should be “record v4_r1”)

  10. digitaltut
    March 16th, 2021

    @all: Thanks for your detection, we updated Q.2.

  1. No trackbacks yet.