350-701 · Question #347
An engineer is configuring their router to send NetfFow data to Stealthwatch which has an IP address of 1.1.1.1 using the flow record Stealthwatch406143794 command. Which additional command is require
The correct answer is B. match ipv4 ttl. To complete a NetFlow flow record definition for Stealthwatch, a 'match' command, such as match ipv4 ttl, is required to specify which fields of the IP flow data should be collected and matched.
Question
An engineer is configuring their router to send NetfFow data to Stealthwatch which has an IP address of 1.1.1.1 using the flow record Stealthwatch406143794 command. Which additional command is required to complete the flow record?
Options
- Atransport udp 2055
- Bmatch ipv4 ttl
- Ccache timeout active 60
- Ddestination 1.1.1.1
How the community answered
(19 responses)- A5% (1)
- B79% (15)
- C5% (1)
- D11% (2)
Why each option
To complete a NetFlow flow record definition for Stealthwatch, a 'match' command, such as `match ipv4 ttl`, is required to specify which fields of the IP flow data should be collected and matched.
`transport udp 2055` is part of the flow exporter configuration, not the `flow record` itself. The record defines what to collect, the exporter defines where and how to send it.
When defining a NetFlow flow record using the `flow record <name>` command, it's essential to specify which fields should be included in the record. The `match` command is used to define key fields that form the identity of a flow, like source/destination IP, ports, and protocols. `match ipv4 ttl` is a valid command to include the IPv4 Time To Live field as part of the flow definition, which is a common requirement for comprehensive flow analysis.
`cache timeout active 60` is related to the flow monitor configuration, specifically how long active flows are kept in the cache before export, not part of the `flow record` definition.
`destination 1.1.1.1` is part of the flow exporter configuration, specifying where the collected flow data should be sent, not part of the `flow record` definition.
Concept tested: Cisco NetFlow record configuration
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/cfg-nflow-exp-v9-v5.html
Topics
Community Discussion
No community discussion yet for this question.