300-410 NetFlow and Flexible NetFlow — Timed 15 Questions

Question 1

A network engineer is troubleshooting a sudden drop in NetFlow data on a Cisco router running IOS-XE 17.x. The engineer verifies that 'ip flow-export destination 10.1.1.100 2055' is configured, and the collector is reachable. However, 'show ip flow export' shows zero packets exported. What is the most likely cause?

Accepted Answer

No flow monitor is applied to any interface.. The issue is that NetFlow generation requires at least one monitor or flow record to be applied to an interface. Without a 'ip flow monitor' or 'ip route-cache flow' command on an interface, no flows are created and thus nothing is exported.

Answer

The collector IP address is incorrect.

Answer

The export version is set to 9 but the collector expects version 5.

Answer

The router is in a VRF that is not configured for NetFlow export.

Question 2

An engineer configures Flexible NetFlow on a Cisco router to monitor traffic on GigabitEthernet0/1. The flow record is defined with 'match ipv4 source address' and 'collect counter bytes'. The flow exporter sends data to 192.168.1.10:2055. After applying the monitor to the interface, 'show flow monitor name MONITOR cache' shows zero entries. What is the most likely root cause?

Accepted Answer

The flow monitor is applied in the wrong direction.. Flexible NetFlow requires a flow monitor to be applied to an interface in the correct direction (ingress or egress). If the direction is not specified, the default is ingress. If traffic is only egress, the monitor will not capture any flows.

Answer

The flow exporter is not configured with a source interface.

Answer

The flow record does not include 'match ipv4 protocol'.

Answer

The collector is unreachable, causing the router to stop caching flows.

Question 3

A network engineer configures Flexible NetFlow to export traffic statistics for a VRF named CUSTOMER_A. The configuration includes 'flow exporter EXPORTER' with destination 10.10.10.10:2055 and 'vrf CUSTOMER_A' under the exporter. The flow monitor is applied to the VRF interface. However, 'show flow monitor name MONITOR cache' shows no entries for VRF traffic. What is the most likely cause?

Accepted Answer

The flow monitor is applied to the global routing table interface instead of the VRF interface.. For VRF-aware NetFlow, the flow monitor must be applied using the 'ip flow monitor MONITOR input' command under the VRF interface, and the exporter must reference the VRF. A common mistake is forgetting to apply the monitor to the interface in the VRF context.

Answer

The exporter is missing the 'source' interface command.

Answer

The VRF is not configured with 'ip flow-export' commands.

Answer

The flow record does not match any VRF-specific fields.

Question 4

An engineer notices that NetFlow export packets are being sent from a router but the collector reports missing data for certain flows. The engineer checks 'show ip flow export' and sees 'Exporting flows to 10.1.1.100 (2055)' with packets being sent. However, 'show flow monitor name MONITOR cache' shows many flows with zero byte counts. What is the most likely cause?

Accepted Answer

The flow record includes 'collect counter packets' but not 'collect counter bytes'.. If the flow record only collects packet counts but not byte counts, the byte counter will remain zero. This is a configuration error in the flow record definition.

Answer

The flow exporter is using UDP port 2055, but the collector expects TCP.

Answer

The router's CPU is overloaded, causing byte counters to not update.

Answer

The flow monitor is applied in egress direction, which does not support byte collection.

Question 5

A network engineer configures a Flexible NetFlow monitor to capture traffic on a router's WAN interface. The flow record includes 'match ipv4 source address', 'match ipv4 destination address', and 'collect counter bytes'. After applying the monitor, 'show flow monitor name MONITOR cache' shows flows, but the collector receives no data. 'show flow exporter name EXPORTER statistics' shows 'Export packets sent: 0'. What is the most likely cause?

Accepted Answer

The flow monitor is not associated with any flow exporter.. A flow exporter must be associated with the flow monitor. If the monitor does not reference the exporter, no data is exported even if flows are cached.

Answer

The flow exporter is configured with the wrong destination IP address.

Answer

The flow exporter is missing the 'source' interface command.

Answer

The flow cache is full, preventing new exports.

Question 6

An engineer configures Flexible NetFlow on a router to monitor both IPv4 and IPv6 traffic. The flow record is defined with 'match ipv4 source address' and 'match ipv6 source address'. After applying the monitor to an interface, 'show flow monitor name MONITOR cache' shows only IPv4 flows. What is the most likely cause?

Accepted Answer

The flow record cannot combine IPv4 and IPv6 match fields; separate monitors are needed.. A single flow record cannot mix IPv4 and IPv6 match fields; they are separate address families. The engineer must create two separate flow monitors—one for IPv4 and one for IPv6—and apply both to the interface.

Answer

IPv6 traffic is not present on the interface.

Answer

The interface does not have IPv6 enabled.

Answer

The flow exporter is not configured to send IPv6 flows.

Question 7

A network engineer configures NetFlow on a router using the legacy 'ip flow-export' commands. After applying 'ip route-cache flow' on an interface, 'show ip flow export' shows packets being sent, but the collector reports that all flows have a source IP of the router's management interface instead of the actual source IPs. What is the most likely cause?

Accepted Answer

The 'ip flow-export source' command is set to the management interface, which becomes the source IP of export packets.. In legacy NetFlow, the 'ip flow-export source' command sets the source IP of export packets, not the flow data. The symptom described is normal; the collector sees the source IP of the export packets, not the flow source IPs. However, if the collector is misconfigured to interpret the export source as flow source, that is a collector issue. But more likely, the engineer is misreading the collector output. The question tests understanding that export source IP is not the flow source.

Answer

The router is performing NAT on the flow data before exporting.

Answer

The flow record is configured to match the router's interface IP as the source.

Answer

The collector is misconfigured to display the export packet source instead of the flow source.

Question 8

An engineer configures Flexible NetFlow with a flow record that includes 'match ipv4 protocol' and 'collect counter packets'. The flow monitor is applied to an interface. 'show flow monitor name MONITOR cache' shows flows, but the packet counts are much lower than expected based on interface counters. What is the most likely cause?

Accepted Answer

The flow monitor is applied only in the ingress direction, missing egress traffic.. Flexible NetFlow uses sampled NetFlow by default unless 'sampler' is explicitly configured. However, the default sampling rate is 1 (no sampling). The issue might be that the monitor is applied only in one direction (ingress or egress) while traffic is bidirectional, so only half the traffic is captured.

Answer

The flow record does not include 'match ipv4 source address', causing flows to be aggregated incorrectly.

Answer

The router is using sampled NetFlow with a default sampling rate of 1:1000.

Answer

The flow exporter is rate-limiting the export, causing cache entries to be dropped before counting.

Question 9

A network engineer configures Flexible NetFlow on a router to monitor traffic on a trunk interface with multiple VLANs. The flow monitor is applied to the physical interface. The engineer notices that all flows show the same VLAN ID in the collector, even though traffic from different VLANs is present. What is the most likely cause?

Accepted Answer

The flow record does not include any VLAN match fields.. To capture VLAN information in Flexible NetFlow, the flow record must include 'match dot1q vlan' or 'match vlan' fields. Without these, the VLAN ID is not recorded, and the collector may show a default or incorrect value.

Answer

The trunk interface is not configured with 'switchport trunk encapsulation dot1q'.

Answer

The flow monitor is applied only to the physical interface, not the subinterfaces.

Answer

The collector does not support VLAN fields.

Question 10

A network engineer runs the following command on Router R1:

R1# show flow exporter EXPORTER-1

Flow Exporter EXPORTER-1:
  Description: Exports to collector
  Export protocol: NetFlow Version 9
  Transport Configuration:
    Destination IP address: 192.168.1.100
    Source IP address: 10.0.0.1
    Transport Protocol: UDP
    Destination Port: 2055
    Source Port: 0
  Collector Configuration:
    VRFs:
      Default
  Options Configuration:
    Sampler: Not configured
  Export Statistics:
    Number of Flows exported: 0
    Number of Packets exported: 0
    Number of Source IP address unreachable: 0
    Number of Packets dropped: 0

Based on this output, what is the most likely reason that no flows are being exported?

Accepted Answer

The flow exporter is not referenced in any flow monitor applied to an interface.. The output shows 0 flows exported, but no errors. This often indicates that the flow monitor is not applied to an interface or the exporter is not referenced in a flow monitor. The exporter itself is configured correctly with a valid destination.

Answer

The destination port is incorrect; NetFlow version 9 requires port 9996.

Answer

The source IP address is not reachable from the destination.

Answer

The sampler is not configured, causing all packets to be dropped.

Question 11

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type:                               Normal
Cache size:                               1000
Current entries:                          0
High Watermark:                           0

Flows added:                              0
Flows aged:                               0
  - Active timeout (1800 secs)           0
  - Inactive timeout (15 secs)           0
  - Event aged                           0
  - Watermark aged                       0
  - Emergency aged                       0

Based on this output, what is the most likely problem?

Accepted Answer

The flow monitor is not applied to any interface.. The cache shows 0 current entries and 0 flows added, indicating no traffic is being captured. This often means the flow monitor is not applied to any interface.

Answer

The cache size is too small at 1000 entries.

Answer

The active timeout is too long at 1800 seconds.

Answer

The cache type is Normal, which requires a sampler.

Question 12

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type:                               Normal
Cache size:                               1000
Current entries:                          500
High Watermark:                           800

Flows added:                              15000
Flows aged:                               14500
  - Active timeout (1800 secs)           12000
  - Inactive timeout (15 secs)           2500
  - Event aged                           0
  - Watermark aged                       0
  - Emergency aged                       0

Based on this output, what is a valid conclusion?

Accepted Answer

Most flows are long-lived, as indicated by the high number of active timeout expirations.. The cache has 500 current entries, with many flows added and aged. The high watermark of 800 indicates the cache has been near full, but no emergency aging occurred. The active timeout accounts for most aging, meaning flows are long-lived.

Answer

The cache is experiencing packet drops due to overflow.

Answer

The inactive timeout is set too high at 15 seconds.

Answer

The cache size should be increased to 2000 entries.

Question 13

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 statistics

Monitor: FLOW-MONITOR-1
  Record: netflow-original
  Exporter: EXPORTER-1
  Cache size: 1000
  Current entries: 0
  Flows exported: 0
  Packets exported: 0

Sampler: Not configured

Flow Monitor is not attached to any interface

Based on this output, what action should the engineer take to resolve the issue?

Accepted Answer

Apply the flow monitor to an interface using the 'ip flow monitor FLOW-MONITOR-1 input' command.. The output explicitly states 'Flow Monitor is not attached to any interface'. The solution is to apply the flow monitor to an interface using the 'ip flow monitor' command.

Answer

Configure a sampler on the flow monitor.

Answer

Increase the cache size to 2000 entries.

Answer

Change the record type to netflow ipv4 original.

Question 14

A network engineer runs the following command on Router R1:

R1# show flow exporter EXPORTER-1 statistics

Flow Exporter: EXPORTER-1
  Packet send statistics (last 30 seconds):
    Packets sent: 0
    Packets dropped: 0
    Packets unsent: 0

Client send statistics:
    Packets sent: 0
    Packets dropped: 0
    Packets unsent: 0

Export statistics:
    Number of Flows exported: 0
    Number of Packets exported: 0
    Number of Source IP address unreachable: 0
    Number of Packets dropped (no route): 0
    Number of Packets dropped (queue full): 0

Based on this output, what is the most likely cause of no exports?

Accepted Answer

The flow exporter is not referenced in any flow monitor, or the flow monitor is not attached to an interface.. The exporter statistics show no flows exported and no errors. This typically means the exporter is not receiving any flows from a flow monitor, likely because the flow monitor is not attached to an interface or the flow monitor does not reference this exporter.

Answer

The destination IP address is unreachable.

Answer

The UDP port is blocked by a firewall.

Answer

The source IP address is not configured on any interface.

Question 15

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type:                               Normal
Cache size:                               1000
Current entries:                          1000
High Watermark:                           1000

Flows added:                              50000
Flows aged:                               49000
  - Active timeout (1800 secs)           40000
  - Inactive timeout (15 secs)           8000
  - Event aged                           0
  - Watermark aged                       1000
  - Emergency aged                       0

Based on this output, what is the most likely issue?

Accepted Answer

The cache size is too small, causing watermark aging and potential loss of flow data.. The cache is full (1000 current entries, high watermark 1000), and watermark aging has occurred (1000 flows aged due to watermark). This indicates the cache is overflowing, causing flows to be aged prematurely to make room for new flows. This can lead to incomplete data.

Answer

The active timeout is set too low at 1800 seconds.

Answer

The inactive timeout is set too low at 15 seconds.

Answer

The flow exporter is not configured.