CCNP ENCOR reference
Flexible NetFlow Quick Reference
Flow records, exporters, and monitors — the three components tested in ENCOR objective 4.3, and the most common reason NetFlow captures nothing.
The three components
Flow record: defines what to track — key fields (distinguish one flow from another, like source/destination IP and port) and non-key fields (statistics collected per flow, like byte/packet counters).
Flow exporter: defines where completed flow data is sent — typically a NetFlow collector's IP address and UDP port.
Flow monitor: ties a record and exporter together, and must be explicitly applied to an interface with 'ip flow monitor ... input' (or output) — this is the single most commonly forgotten step. A correctly defined record/exporter/monitor triplet captures nothing until it's actually applied to an interface.
Flow vs. full packet capture
A NetFlow flow is an aggregated summary (byte/packet counts, duration) of packets sharing common key-field values — not a copy of every packet's full contents. This makes it dramatically more efficient for always-on, network-wide visibility, at the cost of not preserving payload detail the way a full capture does.
Troubleshooting checklist
| Symptom | Most likely cause |
|---|---|
| show flow monitor statistics shows zero entries | Flow monitor never applied to an interface (missing 'ip flow monitor ... input') |
| Entries captured but collector shows nothing | Exporter destination unreachable, or wrong port |
| Flows captured but not distinguishing traffic as expected | Flow record missing the key fields actually needed |