Question

A service provider engineer is building a Flexible NetFlow (IPFIX) configuration on an IOS XR PE router to export traffic statistics. In the flow record, the engineer configures source and destination IPv4 addresses, IP protocol, and Layer 4 ports as 'match' fields, and byte/packet counters plus first/last timestamps as 'collect' fields. During validation, a colleague asks why some fields are configured as 'match' and others as 'collect'. What is the correct explanation of the distinction between match and collect fields in a Flexible NetFlow record?

Accepted Answer

Match fields define the key fields that uniquely identify a flow; collect fields are non-key fields whose values are gathered and aggregated for each flow.

Answer

Match fields are exported only to IPFIX collectors while collect fields are exported only to legacy NetFlow v9 collectors.

Answer

Match fields are sampled at the configured sampling rate, while collect fields are captured on every single packet regardless of sampling.

Answer

Match fields determine which interfaces the record is applied to, while collect fields determine the export destination and transport.