[c-nsp] MPLS Netflow capabilities

[Joe Loiacono]

cisco-nsp-bounces at puck.nether.net wrote on 05/10/2011 01:44:35 PM:

> On Tue, 10 May 2011, cisconsp at SecureObscure.com wrote:
> 
> > Can the ASR9k acting as a pure MPLS P router collect the IP header 
netflow
> > information for export from MPLS encapsulated traffic ingressing or
> > egressing a given interface? Or is this feature only supported in a PE 
role?
> 
> I don't have any direct experience with the ASR9K yet, but my guess 
would 
> be that whatever Netflow data export is done does not involve unwrapping 

> the MPLS packets to look at the header data of the encapsulated IP 
packet.
> I could be wrong though...

For a little more info (though confusing to know what is the latest):

See: 
http://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9_ps6601_Products_White_Paper.html


Table 6. NetFlow Version 9 Field Type Definitions (those related to MPLS)

Field Type            Value    Length   Description

MPLS_TOP_LABEL_TYPE      46    1        MPLS Top Label Type: 0x00 UNKNOWN 
0x01 TE-MIDPT 0x02 ATOM 0x03 VPN 0x04 BGP 0x05 LDP
MPLS_TOP_LABEL_IP_ADDR   47    4        Forwarding Equivalent Class 
corresponding to the MPLS Top Label
MPLS_LABEL_1             70    3        MPLS label at position 1 in the 
stack. This comprises 20 bits of MPLS label, 3 EXP (experimental) bits and 
1 S (end-of-stack) bit.
...
MPLS_LABEL_1             79    3        MPLS label at position 10 in the 
stack. This comprises 20 bits of MPLS label, 3 EXP (experimental) bits and 
1 S (end-of-stack) bit.

Joe