Cisco AVC reporting URLs with IPFIX

Mike Patterson speaks out
Learn more about Mike Patterson...
Archive

Aironet

Competitive Lab Tests

Subscribe to Bloggers speak out on BradReese.Com

Cisco AVC reporting URLs with IPFIX

Cisco AVC IPFIX exports allow for much richer details when investigating potential cyber threats. Imagine having the ability to find out which URL an end user clicked on to get infected. Who else clicked on the same URL?

Sanford, ME: Sun, 3/17/13 - 10:00pm View comments

Cisco Application Visibility and Control (AVC) reporting provides details on URLs, latency, retransmits, etc. and get this: Cisco switched to IPFIX instead of NetFlow v9 to export the data! It's still a Flexible NetFlow configuration to setup AVC exports, but IPFIX is the transport.

We tested AVC using IOS version 15.2(4)M2 and found that we could export details on application name (similar to NBAR), server and client response time as well as total overall response time. There are counters for transactions, retransmissions, connections, responses, etc. I'm still learning about it. I also read that we can export details on WAAS such as dre, lz, optimization segment, connection mode, etc.

Perhaps one of the most exciting updates is the ability to export URLs using IPFIX, since this has been a long time coming:

Introducing URLs Exported with IPFIX

The above brings us to why Cisco AVC made the switch from NetFlow v9 to IPFIX, can you guess why?

First of all, IPFIX is the proposed standard for flow exports and Cisco probably wants to adhere to the standard. Also, IPFIX allows for the export of variable length strings which URLs certainly apply to.

Business Value of AVC

AVC is a combined architecture which contains several other next generation NetFlow exports: NBAR2, Performance Routing and Performance Agent. The intention is that AVC will provide a solution for discovering and controlling applications. Network admins can gain visibility into applications running in their networks and their performance and apply policy to improve application performance and control network resource usage. Basically, it means putting first things first. Business applications receive priority routing and bandwidth. AVC IPFIX exports are how we verify and confirm that the applications are running at peak performance.

Forensic Network Analysis

The contextual details offered up by AVC IPFIX exports allow for much richer details when investigating potential cyber threats. Imagine having the ability to find out which URL an end user clicked on to get infected. Who else clicked on the same URL?

Where to get AVC

AVC is available on the Cisco ASR 1000 Series Aggregation Services Routers and Cisco Integrated Service Routers Generation 2 (ISR G2). Take an Advanced NetFlow training class in a city near you to learn more about "What is Cisco AVC."

View the following informative Cisco Application Visibility and Control (AVC) video featuring Matt Bolick and the always entertaining Jimmy Ray Purser: