Netflow

Create a Flow Record

flow record <FLOW-RECORD>
 description NetFlow record format to send to StealthWatch
 match datalink vlan input  
 match ipv4 tos    
 match ipv4 protocol    
 match ipv4 source address    
 match ipv4 destination address    
 match transport source-port    
 match transport destination-port    
 match interface input    
 collect interface output   
 collect counter bytes long   
 collect counter packets long   
 collect timestamp absolute sys-uptime first   
 collect timestamp absolute sys-uptime last   
exit

Create a Flow Exporter

flow exporter <FLOW-EXPORTER>
 description Export NetFlow to StealthWatch
 destination 199.128.2.14
 source lo0
 transport udp 2055
exit

Create a Flow Monitor

flow monitor IPv4_NETFLOW
 record <FLOW-RECORD>
 exporter <FLOW-EXPORTER>
 cache timeout active 60
exit