Enhanced NetFlow

Recent Cisco switches and routers can export Enhanced NetFlow as part of encrypted traffic analytics capabilities. You can configure Cisco XDR to collect this telemetry. This enables new types of detections.

No additional licenses are required to send network flow data or telemetry to the cloud.

Two categories of data are sent to the cloud over HTTPS, and stored encrypted while at rest:

  • Network flow records

  • Records for encrypted traffic analytics, if you have an encrypted traffic analytics enabled switch and router and configure the Cisco XDR sensor to pass the records

The network flow records can include:

  • IP address of host endpoint

  • TCP or UDP port

  • mac address

  • protocol data (contains miscellaneous data, such as URLS, SSL certificates, and special characters for header data)

  • number of bytes and packets sourced per period

  • FIN packet count

  • flow identifier

  • service ID

  • Palo Alto application ID

  • username

  • MPLS label

  • round trip time

  • start time

  • port range

  • group IDs

  • SYN packet count

  • TrustSec security group tag id and name

  • well-known service port

  • application ID

  • sensor application ID

  • VLAN ID

  • retransmit count

  • list of exporters

  • sensor IP Address

  • last active time

  • autonomous system number

  • VM ID

  • RST packet count

  • number of total bytes and packets since flow started

  • protocol

  • packet shaper application ID

  • NBAR application ID

  • connection count

  • server response time

  • flow sequence number

  • SVRD metric

Encrypted traffic analytics flow records are only sent if you have an encrypted traffic analytics enabled switch or router, and configure the sensor to collect Enhanced NetFlow.

The encrypted traffic analytics flow records include:

  • initial data packet (IDP)

    The Initial Data Packet (IDP) contains mostly protocol related data and headers, such as Server Name Indication (SNI), protocol versions, offered and selected cypher suite and HTTP header fields (in case of unencrypted HTTP traffic). For protocols other than HTTPS/HTTP, it contains the protocol headers for the first 1500 bytes of the client/server communication (usually encrypted on the protocol level without the possibility of decryption without the rest of the data).

  • TLS session ID

  • sequence of packet lengths and times (SPLT)

  • selected cipher suite

  • transport layer security (TLS) version

If you deploy a sensor version 4.0 or greater, you can configure it to collect Enhanced NetFlow telemetry, which enables new types of observations and alerts.

  1. Download the latest version of the sensor install file. For details, see Download the sensor ISO file.

  2. Configure your sensor to pass Enhanced NetFlow Telemetry. Ensure that you choose Enhanced NetFlow (et-analytics) from the Probe Type drop-down list, UDP as the Protocol, and Standard as the Source. For details, see Add a Probe.

  3. Locate the added sensor in the Sensors tab in Cisco XDR to verify the sensor's health status. For details, see Confirm a Sensor Connection.