Routers & Switches

ip netstream export source 10.1.2.1
ip netstream export host 10.1.2.2 3000
ip netstream export version 9
ip netstream export index-switch 32
interface gigabitethernet 1/0/0
ip netstream sampler fix-packets 1 inbound
ip netstream sampler fix-packets 1 outbound
ip netstream inbound
ip netstream outbound

Set the active aging time to 20 minutes and the inactive aging time to 100 seconds, and enable FIN- and RST-based aging:

ip netstream timeout active 20
ip netstream timeout inactive 100
ip netstream tcp-flag enable

Verifying the configuration:

display ip netstream statistic
display ip netstream all
display ip netstream global

Optionally, create custom flexible record

Note that it must be done before running ip netstream command

ip netstream record myrecord
match ip source-address
match ip destination-address
match ip source-port
match ip destination-port
collect counter bytes
collect counter packets
collect interface input
collect interface output

For Huawei S Series where NetStream is not supported and we have to use sFlow. The lowest sample rate is 256 and the smallest polling interval is 20 sec (depending on the size of the switch):

interface GigabitEthernet0/0/1
sflow counter-sampling collector 1
sflow counter-sampling interval 20
sflow flow-sampling collector 1
sflow flow-sampling rate 256

interface GigabitEthernet0/0/48
sflow counter-sampling collector 1
sflow counter-sampling interval 20
sflow flow-sampling collector 1
sflow flow-sampling rate 256

sflow collector 1 ip 192.168.34.210
sflow agent ip 192.168.34.197