MPLS-aware NetFlow

This document describes that Multiprotocol Label Switching (MPLS)-aware NetFlow is an extension of the NetFlow accounting feature that provides highly granular traffic statistics for Cisco routers. MPLS-aware NetFlow collects statistics on a per-flow basis just as NetFlow does. A flow is a unidirectional set of packets (IP or MPLS) that arrives at the router on the same subinterface, has the same source and destination IP addresses, has the same Layer 4 protocol, the same TCP/UDP source and destination ports, and the same type of service (TOS) byte in the IP header. In addition, an MPLS flow contains up to three of the same incoming MPLS labels of interest with experimental bits and end-of-stack bits in the same positions in the packet label stack. MPLS-aware NetFlow captures MPLS traffic that contains both IP and non-IP packets. It reports non-IP packets, but sets the IP NetFlow fields to 0. It can also be configured to capture and report IP packets, setting to 0 the IP NetFlow fields. MPLS-aware NetFlow uses the NetFlow Version 9 export format. MPLS-aware NetFlow exports up to three labels of interest from the incoming label stack, the IP address associated with the top label, as well as traditional NetFlow data.