One document matched: draft-claise-netflow-9-02.txt
Differences from draft-claise-netflow-9-01.txt
Internet Draft
Expiration: December 2003 B. Claise
Document: draft-claise-netflow-9-02.txt Cisco Systems
Category: Informational June 2003
Cisco Systems NetFlow Services Export Version 9
Status of this Memo
This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts. Internet-Drafts are draft documents valid for a maximum of
six months and may be updated, replaced, or obsolete by other
documents at any time. It is inappropriate to use Internet-Drafts as
reference material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
Abstract
This document discusses the Cisco Systems NetFlow services that
provide network administrators with access to IP flows information.
The NetFlow services create flow records that are exported to a
NetFlow collector. The exported flow records can be used for a
variety of purposes, including network management and planning,
accounting, departmental chargebacks, Internet Service Provider
(ISP) billing, data warehousing, and data mining for marketing
purposes.
This document focuses on the most recent evolution of the NetFlow
flow record export format, which is known as version 9. The
distinguishing feature of the NetFlow version 9 export format,
compared with previous formats, is that it is template based. The
templates (collections of fields with the corresponding description
of their structures and their semantics) provide a flexible and
Claise Informational [Page 1]
Cisco Systems NetFlow Services Export Version 9 June 2003
extensible design to the flow record export format. This facilitates
future enhancements to NetFlow services without requiring changes to
the basic flow record export format. Another advantage is that only
the required fields are exported within the flow record, which
minimizes the consumed export bandwidth.
Conventions used in this document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119.
Table of Contents
1. Introduction...................................................2
1.1 Overview...................................................2
1.2 Applications...............................................3
2. Terminology....................................................5
2.1 Terminology Summary Table..................................8
3. NetFlow High-Level Picture on the Exporter.....................8
3.1 The NetFlow Process on the Exporter........................8
3.2 Flow Expiration............................................9
3.3 Transport Protocol.........................................9
4. Packet Layout..................................................9
5. Export Packet Format..........................................11
5.1 Header Format.............................................11
5.2 Template FlowSet Format...................................13
5.3 Data FlowSet Format.......................................14
6. Options.......................................................15
6.1 Options Template FlowSet Format...........................16
6.2 Options Data Record Format................................18
7. Template Management...........................................19
8. Field Type Definitions........................................20
9. The Collector's Side..........................................26
10. Examples.....................................................26
10.1 Packet Header Example....................................27
10.2 Template FlowSet Example.................................27
10.3 Data FlowSet Example.....................................28
10.4 Options Template FlowSet Example.........................29
10.5 Data FlowSet with Options Data Records Example...........30
11. References...................................................30
12. Authors......................................................30
13. Acknowledgments..............................................31
1. Introduction
1.1 Overview
Claise Informational [Page 2]
Cisco Systems NetFlow Services Export Version 9 June 2003
NetFlow services data can be used for a variety of purposes. A
partial list is available in the next section. This paper discusses
the most recent evolution of the NetFlow flow record format known as
version 9. The distinguishing feature of the NetFlow version 9
format, compared with previous formats, is that it is template
based. A template is a collection of fields with corresponding
descriptions of their structures and their semantics.
This approach provides the following advantages:
- Using the template mechanism, new fields can be added to
NetFlow flow records without changing the structure of the export
record format. With previous NetFlow versions, adding a new field in
the flow record implied a new version of the export protocol format
and a new version of the NetFlow collector that supports the parsing
of this new export protocol format.
- Templates that are sent to the collector contain the structural
information about the exported flow records fields. Therefore, if
the collector does not understand the semantics of new fields, it
can still interpret the flow record.
- Because the template mechanism is flexible, it allows the
export of only the required fields from the flows to the NetFlow
collector. This helps to reduce the exported flow data volume and
possibly provide memory savings at the exporter and collector.
Sending only the required information can also reduce network load.
1.2 Applications
NetFlow services data enables several critical customer
applications:
Accounting and Billing
NetFlow services data provides fine-grained metering (for example,
flow records include details such as IP addresses, packet and byte
counts, timestamps, Type of Service (ToS), application ports, etc.)
for highly flexible and detailed resource usage accounting. ISPs can
use this information to migrate from single fee, flat-rate billing
to more flexible charging mechanisms based on time of day, bandwidth
usage, application usage, quality of service, etc. Enterprise
customers can use this information for departmental chargeback or
cost allocation for resource usage.
Claise Informational [Page 3]
Cisco Systems NetFlow Services Export Version 9 June 2003
Network Planning
NetFlow services data captured over a long period of time can be
used to track and anticipate network growth and plan upgrades to
increase the number of routing devices, ports, or higher-bandwidth
interfaces. NetFlow services data optimizes both strategic network
planning (peering, backbone upgrade planning, and routing policy
planning) as well as tactical network engineering decisions
(upgrading the router or link capacity). This helps to minimize the
total cost of network operations while maximizing network
performance, capacity, and reliability.
Peering Agreements
NetFlow services data enables ISP peering partners to measure the
volume and characteristics of traffic exchanged with other ISP
peers.
Traffic Engineering
NetFlow services data provides traffic engineering details for a set
of prefixes. This data can be used in network optimization for load
balancing traffic across alternate paths, or for forwarding traffic
of a certain set of prefixes on a preferred route.
Network Monitoring
NetFlow services data enables extensive near real-time network
monitoring capabilities. NetFlow services data analysis can be used
to display traffic patterns associated with routing devices and
switches on an individual or network wide basis. This can display
traffic or application-based views and therefore provide proactive
problem detection, efficient troubleshooting, and rapid problem
resolution.
Application Monitoring and Profiling
NetFlow services data enables content and service providers to view
detailed, time-based, and application-based usage of a network. This
information allows planning and allocation of network and
application resources (such as Web server, gaming, or multimedia).
User Monitoring and Profiling
NetFlow services data provides a detailed understanding of customer
or end-user usage of network and application resources. This
information can then be used to efficiently plan and allocate
Claise Informational [Page 4]
Cisco Systems NetFlow Services Export Version 9 June 2003
access, backbone, and application resources, as well as to detect
and resolve potential security and policy violations.
Security Analysis
NetFlow services data provides details on source and destination
addresses, along with the start time of flows and application ports.
This data can be used to analyze network security and identify
attacks.
NetFlow Data Warehousing and Mining
NetFlow services data (or derived information) can be stored for
later retrieval and analysis to support proactive marketing and
customer service programs. An example of this would be to determine
which applications and services are being used by internal and
external users and then target them for improved service such as
advertising. This is especially useful for ISPs because NetFlow
services data enables them to create better service packaging.
2. Terminology
Various terms used in this document are described below:
IP Flow or Flow
A Flow is defined as a set of IP packets passing an Observation
Point in the network during a certain time interval. All packets
that belong to a particular Flow have a set of common properties
derived from the data contained in the packet and from the packet
treatment at the Observation Point.
Flow Record
A Flow Record provides information about an IP Flow that exists on
the Exporter. In this document, the Flow Records are also referred
to as NetFlow services data, NetFlow data, or Flow Data Record.
Exporter
A device (for example, a router) with NetFlow services enabled, the
Exporter monitors packets entering an Observation Point and creates
Flows out of these packets. The information from these Flows is
exported in the form of Flow Records to the NetFlow Collector.
NetFlow Collector
The NetFlow Collector receives Flow Records from one or more
Exporters. It processes the received Export Packet(s); that is
Claise Informational [Page 5]
Cisco Systems NetFlow Services Export Version 9 June 2003
parses and stores the Flow Record information. Flow records can be
optionally aggregated before being stored on the hard disk.
The NetFlow Collector is also referred to as the Collector in this
document.
Observation Point
A location in the network where IP packets can be observed; for
example, one or a set of interfaces of the Exporter.
An Observation Domain is associated with every Observation Point.
Observation Domain:
The set of Observation Points, which is the largest aggregatable set
of Flow information at the Exporter is termed an Observation Domain.
Each Observation Domain presents itself as a unique ID to the
NetFlow Collector for identifying the Export Packets it generates.
For example, a router line card composed of several interfaces with
each interface being an Observation Point.
Export Packet
An Export Packet is a packet originating at the Exporter that
carries the Flow Records of this Exporter and whose destination is
the NetFlow Collector.
Packet Header
The Packet Header is the first part of an Export Packet, which
provides basic information about the packet such as the NetFlow
version, number of records contained within the packet, sequence
numbering, etc.
FlowSet
FlowSet is a generic term for a collection of records that have a
similar structure. In an Export Packet, one or more FlowSets follow
the Packet Header.
There are three different types of FlowSets: Template FlowSet,
Options Template FlowSet, and Data FlowSet. Options Template FlowSet
and Data FlowSet are identified by the FlowSet IDs. An Export Packet
contains one or more FlowSets, and the three FlowSet types can be
mixed within the same Export Packet.
FlowSet ID
An ID used to distinguish the different FlowSets.
FlowSet IDs between 0 and 255 are reserved. The Template FlowSet
uses the fixed FlowSet ID of 0, and the Options Template FlowSet
Claise Informational [Page 6]
Cisco Systems NetFlow Services Export Version 9 June 2003
uses the fixed FlowSet ID of 1. Data FlowSets have a FlowSet ID
greater than 255.
Template Record
A Template Record defines the structure and interpretation of fields
in a data record. Data records that correspond to a template MAY
appear in the same and/or subsequent Export Packets. The template
information is not necessarily carried in every Export Packet. As
such, the NetFlow Collector MUST store the Template Record to
interpret the corresponding data records that are received in
subsequent data packets.
Template FlowSet
A Template FlowSet is a collection of one or more Template Records
that have been grouped together in an Export Packet. A well-known
FlowSet ID identifies the Template FlowSet.
Template ID
A unique number that distinguishes a Template Record from all other
Template Records produced by the same Observation Domain. A NetFlow
Collector that receives Export Packets from several Observation
Domains from the same Exporter MUST be aware that the uniqueness of
the Template ID is not guaranteed across Observation Domains.
Options Template Record
A Template Record that describes the format of the Flow measurement
parameters (for example, the sampling algorithm used, sampling
interval) used at the Exporter.
Options Template FlowSet
An Options Template FlowSet is a collection of one or more Options
Template Records that have been grouped together in an Export
Packet. A well-known FlowSet ID identifies the Options Template
FlowSet.
Options Data Record
The data record that contains values of the Flow measurement
parameters corresponding to an Options Template Record.
Flow Data Record
Claise Informational [Page 7]
Cisco Systems NetFlow Services Export Version 9 June 2003
The data record that contains values of the Flow parameters
corresponding to a Template Record. In this document, Flow Data
Record is also referred to as Flow Record.
Data FlowSet
A Data FlowSet is a collection of one or more Flow or Options Data
Records that are grouped together in an Export Packet. A Data
FlowSet contains records that belong to the same Template ID. Each
Data FlowSet references a previously transmitted Template ID, which
can be used to parse the data contained within the Flow Records.
2.1 Terminology Summary Table
FlowSet Template Record Data Record
+----------------------------------------------------------------+
| | | Flow Data Record(s) |
| Data FlowSet | / | or |
| | | Options Data Record(s) |
+----------------------------------------------------------------+
| Template FlowSet | Template Record(s) | / |
+----------------------------------------------------------------+
| Options Template | Options Template | / |
| FlowSet | Record(s) | |
+----------------------------------------------------------------+
A Data FlowSet is composed of an Options Data Record(s) or Flow Data
Record(s). No Template Record is included.
The Flow Data Record is linked to a Template Record, and the Options
Data Record is linked to an Options Template Record.
A Template FlowSet is composed of Template Record(s). No Flow or
Options Data Record is included.
An Options Template FlowSet is composed of Options Template
Record(s). No Flow or Options Data Record is included.
3. NetFlow High-Level Picture on the Exporter
3.1 The NetFlow Process on the Exporter
The description of the NetFlow process (for example, sampled
NetFlow, full NetFlow, aggregation), which is the way in which Flows
Claise Informational [Page 8]
Cisco Systems NetFlow Services Export Version 9 June 2003
are created from the observed IP packets, is beyond the scope of
this document.
3.2 Flow Expiration
A Flow is considered to be inactive if no packets belonging to the
Flow have been observed at the Observation Point for a given timeout
interval otherwise it is considered as an active flow.
A Flow can be exported under the following conditions:
1. If the Exporter can detect the end of a Flow, it SHOULD export
the Flow Records at the end of the Flow. For example, a Flow
generated by TCP [3] type of traffic where the FIN or RST bits
indicate the end of the Flow.
2. If the Flow has been inactive for a certain period of time.
This inactivity timeout SHOULD be configurable, with a minimum
value of 0 for an immediate expiration. For example, a Flow
generated by UDP [2] type of traffic.
3. For long-lasting Flows, the Exporter SHOULD export the Flow
Records on a regular basis. This periodicity SHOULD be
configurable.
4. If the Exporter experiences internal constraints, a Flow MAY
be forced to expire prematurely (for example, counters wrapping
or low memory).
3.3 Transport Protocol
To achieve efficiency in terms of processing at the Exporter while
handling high volumes of Export Packets, the NetFlow Export Packets
are encapsulated into UDP [2] datagrams for export to the NetFlow
Collector. However, NetFlow version 9 has been designed to be
transport protocol independent. Hence, it can also operate over
congestion-aware protocols such as TCP [3] or SCTP [4].
Note that the Exporter can export to multiple Collectors, using
independent transport protocols.
4. Packet Layout
Claise Informational [Page 9]
Cisco Systems NetFlow Services Export Version 9 June 2003
An Export Packet consists of a Packet Header followed by one or more
FlowSets. The FlowSets can be any of the possible three types:
Template, Data, or Options Template.
Export Packet:
+--------+-------------------------------------------+
| | +----------+ +---------+ +----------+ |
| Packet | | Template | | Data | | Options | |
| Header | | FlowSet | | FlowSet | | Template | ... |
| | | | | | | FlowSet | |
| | +----------+ +---------+ +----------+ |
+--------+-------------------------------------------+
The possible combinations that can occur in an Export Packet are:
- An Export Packet that consists of interleaved Template, Data, and
Options Template FlowSets.
Export Packet:
+--------+--------------------------------------------------------+
| | +----------+ +---------+ +-----------+ +---------+ |
| Packet | | Template | | Data | | Options | | Data | |
| Header | | FlowSet | | FlowSet | ... | Template | | FlowSet | |
| | | | | | | FlowSet | | | |
| | +----------+ +---------+ +-----------+ +---------+ |
+--------+--------------------------------------------------------+
- An Export Packet consisting entirely of Data FlowSets. After the
appropriate Template Records have been defined and transmitted to
the NetFlow Collector device, the majority of Export Packets will
consist solely of Data FlowSets.
Export Packet:
+--------+----------------------------------------------+
| | +---------+ +---------+ +---------+ |
| Packet | | Data | ... | Data | ... | Data | |
| Header | | FlowSet | ... | FlowSet | ... | FlowSet | |
| | +---------+ +---------+ +---------+ |
+--------+----------------------------------------------+
- An Export Packet consisting entirely of Template and Options
Template FlowSets. The Exporter MAY transmit a packet containing
Template FlowSets ahead of time to help ensure that the NetFlow
Claise Informational [Page 10]
Cisco Systems NetFlow Services Export Version 9 June 2003
Collector has the correct Template Records before receiving the
first Data FlowSet.
Export Packet:
+--------+-------------------------------------------------+
| | +----------+ +----------+ +----------+ |
| Packet | | Template | | Template | | Options | |
| Header | | FlowSet | ... | FlowSet | ... | Template | |
| | | | | | | FlowSet | |
| | +----------+ +----------+ +----------+ |
+--------+-------------------------------------------------+
A Template FlowSet provides a description of the fields that would
be present in future Data FlowSets. These Data FlowSets MAY occur
later within the same Export Packet or in subsequent Export Packets.
- An Export Packet consisting entirely of Options Template FlowSets
and Data FlowSets containing Options Data Records, if there is only
options data to be sent.
Export Packet:
+--------+-------------------------------------------------+
| | +----------+ +----------+ +----------+ |
| Packet | | Options | | Data | | Data | |
| Header | | Template | ... | FlowSet | ... | FlowSet | |
| | | FlowSet | | | | | |
| | +----------+ +----------+ +----------+ |
+--------+-------------------------------------------------+
The format of the Template, Data, and Options Template FlowSets will
be discussed later in this document.
5. Export Packet Format
5.1 Header Format
Note that the Packet Header format is similar to the one developed
by the different versions of NetFlow defined by Cisco, for backward
compatibility.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Claise Informational [Page 11]
Cisco Systems NetFlow Services Export Version 9 June 2003
| Version Number | Count |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| sysUpTime |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| UNIX Secs |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Packet Header Field Descriptions
Version
Version of Flow Record format exported in this packet. The
value of this field is 0x0009 for the current version.
Count
Count is the total number of record in the Export
Packet, which is the sum total of Options FlowSet
records, Template FlowSet records and Data FlowSet
records.
SysUpTime
Time in milliseconds since this device was first booted.
Refer to [1].
UNIX Secs
Seconds since 0000 UTC 1970.
Sequence Number
Incremental sequence counter of all Export Packets sent from
the current Observation Domain by the Exporter. This value
will be cumulative, and can be used to identify whether any
Export Packets have been missed.
Source ID
The Source ID field is a 32-bit value that identifies the
Exporter Observation Domain. NetFlow Collectors SHOULD use
the combination of the source IP address and the Source ID
field to separate different export streams originating from
the same Exporter.
Claise Informational [Page 12]
Cisco Systems NetFlow Services Export Version 9 June 2003
5.2 Template FlowSet Format
One of the essential elements in the NetFlow format is the Template
FlowSet. Templates greatly enhance the flexibility of the Flow
Record format because they allow the NetFlow Collector to process
Flow Records without necessarily knowing the interpretation of all
the data in the Flow Record.
The format of the Template FlowSet is as follows:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = 0 | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID 1 | Field Count |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type 1 | Field Length 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type 2 | Field Length 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type N | Field Length N |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID 2 | Field Count |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type 1 | Field Length 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type 2 | Field Length 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type M | Field Length M |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Template FlowSet Field Descriptions
FlowSet ID
FlowSet ID value of 0 is reserved for Template FlowSet.
Length
Claise Informational [Page 13]
Cisco Systems NetFlow Services Export Version 9 June 2003
Total length of this FlowSet. Because an individual Template
FlowSet MAY contain multiple Template Records, the Length
value MUST be used to determine the position of the next
FlowSet record, which could be any type of FlowSet. Length
is the sum total of lengths of FlowSet ID, the Length
itself, and all Template Records within this FlowSet.
Template ID
Each of the newly generated Template Records is given a
unique Template ID. This uniqueness is local to the
Observation Domain that generated the Template ID.
Template IDs 0-255 are reserved for Template FlowSets,
Options FlowSets, and other reserved FlowSet that would be
created in the future. Template IDs of Data FlowSets are
numbered from 256 to 65535.
Field Count
Number of fields in this Template Record. Because a Template
FlowSet usually contains multiple Template Records, this
field allows the Collector to determine the end of the
current Template Record and the start of the next.
Field Type
A numeric value that represents the type of the field. Refer
to the "Field Type Definitions" section.
Field Length
The length of the corresponding Field Type, in bytes. Refer
to the "Field Type Definitions" section.
5.3 Data FlowSet Format
The format of the Data FlowSet is as follows:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = Template ID | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1 - Field Value 1 | Record 1 - Field Value 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1 - Field Value 3 | ... |
Claise Informational [Page 14]
Cisco Systems NetFlow Services Export Version 9 June 2003
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2 - Field Value 1 | Record 2 - Field Value 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2 - Field Value 3 | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 3 - Field Value 1 | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Data FlowSet Field Descriptions
FlowSet ID = Template ID
Each Data FlowSet is associated with a FlowSet ID. The
FlowSet ID maps to a (previously generated) Template ID. The
Collector MUST use the FlowSet ID to find the corresponding
Template Record and decode the Flow Records from the
FlowSet.
Length
The length of this FlowSet.
Length is the sum total of lengths of FlowSet ID, Length
itself, all Flow Records within this FlowSet, and the
padding bytes, if any.
Record N - Field Value M
The remainder of the Data FlowSet is a collection of Flow
Data Record(s), each containing a set of field types and
values. The Type and Length of the fields have been
previously defined in the Template Record referenced by the
FlowSet ID or Template ID.
Padding
Padding SHOULD be inserted so that subsequent FlowSet starts
at a 4-byte aligned boundary. It is important to note that
the Length field includes the padding bits.
Interpretation of the Data FlowSet format can be done only if the
Template FlowSet corresponding to the Template ID is available at
the Collector.
6. Options
Claise Informational [Page 15]
Cisco Systems NetFlow Services Export Version 9 June 2003
6.1 Options Template FlowSet Format
The Options Template Record (and its corresponding Options Data
Record) is used to supply information about the NetFlow process
configuration or NetFlow process specific data, rather than
supplying information about IP Flows.
For example, the sample rate of a specific interface, if sampling is
supported, along with the sampling method used.
The format of the Options Template FlowSet is detailed below:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = 1 | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID | Option Scope Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option Length | Scope 1 Field Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Field Length | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope N Field Length | Option 1 Field Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 1 Field Length | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option M Field Length | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Options Template FlowSet Field Definitions
FlowSet ID = 1
A FlowSet ID value of 1 is reserved for the Options
Template.
Length
Total length of this FlowSet. Each Options Template FlowSet
MAY contain multiple Options Template Records. Thus, the
Length value MUST be used to determine the position of the
next FlowSet record, which could be either a Template
FlowSet or Data FlowSet.
Claise Informational [Page 16]
Cisco Systems NetFlow Services Export Version 9 June 2003
Length is the sum total of lengths of FlowSet ID, the Length
itself, and all Options Template Records within this FlowSet
Template ID.
Template ID
Template ID of this Options Template. This value is greater
than 255.
Option Scope Length
The length in bytes of any Scope fields definition contained
in the Options Template Record (The use of "Scope" is
described below).
Option Length
The length (in bytes) of any options field definitions
contained in this Options Template Record.
Scope 1 Field Type
The relevant portion of the Exporter/NetFlow process to
which the Options Template Record refers.
Currently defined values are:
0x0001 System
0x0002 Interface
0x0003 Line Card
0x0004 Cache
0x0005 Template
For example, the NetFlow process can be implemented on a
per-interface basis, so if the Options Template Record were
reporting on how the NetFlow process is configured, the
Scope for the report would be 0x0002 (Interface). The
associated interface ID would then be carried in the
associated Options Data FlowSet. The Scope can be limited
further by listing multiple scopes which all have to match
at the same time. Note that the Scope Fields always precede
the Option Fields.
Scope 1 Field Length
The length (in bytes) of the scope field, as it would appear
in an Options Data Record.
Option 1 Field Type
Claise Informational [Page 17]
Cisco Systems NetFlow Services Export Version 9 June 2003
A numeric value that represents the type of field that would
appear in the Options Template Record. Refer to the Field
Type Definitions section.
Option 1 Field Length
The length (in bytes) of the Option Field.
Padding
Padding SHOULD be inserted so that the subsequent FlowSet
starts at a 4-byte aligned boundary. It is important to note
that
the Length field includes the padding bits.
6.2 Options Data Record Format
The Options Data Records are sent in Data FlowSets, on a regular
basis, but not with every Flow Data Record. How frequently these
Options Data Records are exported is configurable. See the Templates
Management" section for more details.
The format of the Data FlowSet containing Options Data Records is as
follows:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = Template ID | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1 - Scope 1 Value |Record 1 - Option Field 1 Value|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Record 1 - Option Field 2 Value| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2 - Scope 1 Value |Record 2 - Option Field 1 Value|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Record 2 - Option Field 2 Value| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 3 - Scope 1 Value |Record 3 - Option Field 1 Value|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Record 3 - Option Field 2 Value| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Claise Informational [Page 18]
Cisco Systems NetFlow Services Export Version 9 June 2003
Options Data Records of the Data FlowSet Field Descriptions
FlowSet ID = Template ID
Each group of Options Data Records within a Data FlowSet is
preceded by a FlowSet ID. The FlowSet ID maps to a
(previously generated) Template ID corresponding to this
Options Template Record. The Collector MUST use the FlowSet
ID to map the appropriate type and length to any field
values that follow.
Length
The length of this FlowSet.
Length is the sum total of lengths of FlowSet ID, Length
itself, all the Options Data Records within this FlowSet,
and the padding bytes, if any.
Record N - Option Field M Value
The remainder of the Data FlowSet is a collection of Flow
Records each containing a set of field types and values. The
Type and Length of the fields have been previously defined
in the Options Template Record referenced by the FlowSet ID
or Template ID.
Padding
Padding SHOULD be inserted so that the subsequent FlowSet
starts at a 4-byte aligned boundary. It is important to note
that the Length field includes the padding bits.
The Data FlowSet format can be interpreted only if the Options
Template FlowSet corresponding to the Template ID is available at
the Collector.
7. Template Management
The Template IDs must remain constant for the life of the NetFlow
process and the Exporter. If the Exporter or the NetFlow process
restarts for any reason, all information about Templates will be
lost and new Template IDs will be created. Template IDs are thus not
guaranteed to be consistent across an Exporter or NetFlow process
restart.
A newly created Template Record is assigned an unused Template ID
from the Exporter. If the template configuration is changed, the
Claise Informational [Page 19]
Cisco Systems NetFlow Services Export Version 9 June 2003
current Template ID is abandoned and not reused until the NetFlow
process or Exporter restarts.
If a configured Template Record on the Exporter is deleted, and re-
configured with exactly the same parameters, the same Template ID
COULD be reused.
The Exporter sends the Template FlowSet and Options Template FlowSet
under the following conditions:
1. After a NetFlow process restarts, the Exporter MUST NOT send any
Data FlowSet without having the corresponding Template FlowSet
and the required Options Template FlowSet sent out in a previous
packet or in the same Export Packet. It MAY transmit the
Template FlowSet and Options Template FlowSet, without any Data
FlowSets, ahead of time to help ensure that the Collector will
have the correct Template Record before receiving the first Flow
or Options Data Record.
2. In the event of configuration changes, the Exporter SHOULD send
the incremental changes at an accelerated rate. In such a case,
it MAY transmit the changed Template Record(s) and Options
Template Record(s), without any data, ahead of time to help
ensure that the Collector will have the correct template
information before receiving the first data.
3. On a regular basis, the Exporter MUST send all the Template
Records and Options Template Records to refresh the Collector.
Template IDs have a limited lifetime at the Collector and MUST
be periodically refreshed.
Two approaches are taken to make sure that Templates get
refreshed at the Collector:
* Every N number of Export Packets.
* On a time basis, so every N number of minutes.
Both options MUST be configurable by the user.
When one of these expiry conditions is met, the Exporter MUST
send the Template FlowSet and Options Template.
8. Field Type Definitions
The following table describes all the field type definitions that an
Exporter MAY support. The fields are a selection of Packet Header
fields, lookup results (for example the autonomous system numbers or
Claise Informational [Page 20]
Cisco Systems NetFlow Services Export Version 9 June 2003
the subnet masks), and properties of the packet itself such as
length.
Field Type Value Length Description
(bytes)
Incoming counter with length
IN_BYTES 1 N N x 8 bits for bytes
associated with an IP Flow
Incoming counter with length
IN_PKTS 2 N N x 8 bits for packets
associated with an IP Flow
FLOWS 3 N Number of Flows
that were aggregated;
by default N is 4
PROTOCOL 4 1 IP protocol byte
TOS 5 1 Type of service byte
TCP_FLAGS 6 1 TCP flags; cumulative of all
the TCP flags seen in this
Flow
TCP/UDP source port number
L4_SRC_PORT 7 2 (for example, FTP, Telnet,
or equivalent)
IPV4_SRC_ADDR 8 4 IPv4 source address
SRC_MASK 9 1 Source route mask bits
Input interface index.
INPUT_SNMP 10 N By default N is 2, but
higher values can be used
TCP/UDP destination port
L4_DST_PORT 11 2 number (for example, FTP,
Telnet, or equivalent)
Claise Informational [Page 21]
Cisco Systems NetFlow Services Export Version 9 June 2003
IPV4_DST_ADDR 12 4 IPv4 destination address
DST_MASK 13 1 Destination route mask bits
Output interface index.
OUTPUT_SNMP 14 N By default N is 2, but
higher values can be used
IPV4_NEXT_HOP 15 4 IPv4 address of the next-hop
router
Source BGP autonomous
SRC_AS 16 N system number where N could
be 2 or 4
Destination BGP autonomous
DST_AS 17 N system number where N could
be 2 or 4
BGP_IPV4_NEXT_HOP 18 4 Next-hop router's IP
in the BGP domain
IP multicast outgoing
MUL_DST_PKTS 19 N packet counter with length
N x 8 bits for packets
associated with the IP Flow
IP multicast outgoing
MUL_DST_BYTES 20 N Octet (byte) counter with
length N x 8 bits for bytes
associated with the IP Flow
SysUptime at which the
LAST_SWITCHED 21 4 last packet of this Flow
was switched
SysUptime at which the
FIRST_SWITCHED 22 4 first packet of this Flow
was switched
IPV6_SRC_ADDR 27 16 IPv6 source address
Claise Informational [Page 22]
Cisco Systems NetFlow Services Export Version 9 June 2003
IPV6_DST_ADDR 28 16 IPv6 destination address
IPV6_SRC_MASK 29 1 Length of the IPv6 source
mask in contiguous bits
IPV6_DST_MASK 30 1 Length of the IPv6
destination mask in
contiguous bits
Flow identifier for a given
FLOW_LABEL 31 3 source/destination pair of
IPv6 traffic
Internet Control Message
ICMP_TYPE 32 2 Protocol (ICMP) packet type;
reported as ICMP Type *
256 + ICMP code
IGMP_TYPE 33 1 Internet Group Management
Protocol (IGMP) packet type
When using sampled NetFlow,
the rate at which packets
SAMPLING_INTERVAL 34 4 are sampled; for example, a
value of 100 indicates that
one of every hundred packets
is sampled
The type of algorithm used
for sampled NetFlow:
SAMPLING_ALGO 35 1 0x01 interval packet
sampling
0x02 pseudorandom sampling
Timeout value (in seconds)
FLOW_ACTIVE_TIMEOUT 36 2 for active Flow entries in
the NetFlow cache
Timeout value (in seconds)
FLOW_INACTIVE_TIMEOUT 37 2 for inactive Flow entries in
the NetFlow cache
Claise Informational [Page 23]
Cisco Systems NetFlow Services Export Version 9 June 2003
ENGINE_TYPE 38 1 Type of Flow switching
engine
ENGINE_ID 39 1 ID number of the Flow
switching engine
Counter with length
N x 8 bits for bytes
TOTAL_BYTES_EXPORTED 40 N for the number of bytes
exported by the Observation
Domain
Counter with length
N x 8 bits for bytes
TOTAL_EXP_PKTS_SENT 41 N for the number of packets
exported by the Observation
Domain
Counter with length
N x 8 bits for bytes
TOTAL_FLOWS_EXP 42 N for the number of Flows
exported by the Observation
Domain
Internet Protocol Version
Set to 4 for IPv4, set to 6
IP_PROTOCOL_VERSION 60 1 for IPv6. If not present in
the template, then version 4
is assumed
Flow direction:
DIRECTION 61 1 0 - ingress flow
1 û egress flow
IPV6_NEXT_HOP 62 16 IPv6 address of the next-hop
router
BPG_IPV6_NEXT_HOP 63 16 Next-hop router in the BGP
domain
Bit-encoded field
IPV6_OPTION_HEADERS 64 4 identifying IPv6 option
Claise Informational [Page 24]
Cisco Systems NetFlow Services Export Version 9 June 2003
headers found in the flow
MPLS_LABEL_1 70 3 MPLS label at position 1 in
the stack
MPLS_LABEL_2 71 3 MPLS label at position 2 in
the stack
MPLS_LABEL_3 72 3 MPLS label at position 3 in
the stack
MPLS_LABEL_4 73 3 MPLS label at position 4 in
the stack
MPLS_LABEL_5 74 3 MPLS label at position 5 in
the stack
MPLS_LABEL_6 75 3 MPLS label at position 6 in
the stack
MPLS_LABEL_7 76 3 MPLS label at position 7 in
the stack
MPLS_LABEL_8 77 3 MPLS label at position 8 in
the stack
MPLS_LABEL_9 78 3 MPLS label at position 9 in
the stack
MPLS_LABEL_10 79 3 MPLS label at position 10
in the stack
The value field is a numeric identifier for the field type.
The following value fields are reserved: from 23 to 26, from 43 to
59, and from 65 to 69.
When extensibility is required, the new field types will be added
to the list. The new field types have to be updated on the Exporter
and Collector but the NetFlow export format would remain unchanged.
Refer to the latest documentation at http://www.cisco.com for the
newly updated list.
Claise Informational [Page 25]
Cisco Systems NetFlow Services Export Version 9 June 2003
9. The Collector's Side
The Collector will receive Template Records from the Exporter,
normally before receiving Flow Data Records (or Options Data
Records). The Flow Data Records (or Options Data Records) can then
be decoded and stored locally on the devices. If the Template
Records have not been received at the time Flow Data Records (or
Options Data Records) are received, the Collector SHOULD store the
Flow Data Records (or Options Data Records) and decode them after
the Template Records are received. A Collector device MUST NOT
assume that the Data FlowSet and the associated Template FlowSet (or
Options Template FlowSet) are exported in the same Export Packet.
The Collector MUST NOT assume that one and only one Template FlowSet
is present in an Export Packet.
The life of a template at the Collector is limited to a fixed
refresh timeout. Templates not refreshed from the Exporter within
the timeout are expired at the Collector. The Collector MUST NOT
attempt to decode the Flow or Options Data Records with an expired
Template. At any given time the Collector SHOULD maintain the
following for all the current Template Records and Options Template
Records: <Exporter, Observation Domain, Template ID, Template
Definition, Last Received>
Note that the Observation Domain is identified by the Source ID
field from the Export Packet.
Template IDs are unique per Exporter and per Observation Domain.
If a new Template Record is received on the Collector (for example
in the case of an Exporter restart) it MUST immediately override the
existing Template Record.
10. Examples
Let's consider the example of an Export Packet composed of a
Template FlowSet, a Data FlowSet (which contains three Flow Data
Records), an Options Template FlowSet and a Data FlowSet (which
contains 2 Options Data Records).
Export Packet:
+--------+---------------------------------------------. . .
| | +--------------+ +-----------------------+
Claise Informational [Page 26]
Cisco Systems NetFlow Services Export Version 9 June 2003
| Packet | | Template | | Data |
| Header | | FlowSet | | FlowSet | . . .
| | | (1 Template) | | (3 Flow Data Records) |
| | +--------------+ +-----------------------+
+--------+---------------------------------------------. . .
. . .+-------------------------------------------------+
+------------------+ +--------------------------+ |
| Options | | Data | |
. . .| Template FlowSet | | FlowSet | |
| (1 Template) | | (2 Options Data Records) | |
+------------------+ +--------------------------+ |
. . .--------------------------------------------------+
10.1 Packet Header Example
The Packet Header is composed of:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Version = 0x0009 | Count = 7 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| sysUpTime |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| UNIX Secs |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
10.2 Template FlowSet Example
We want to report the following Field Types:
- The source IP address (IPv4), so the length is 4
- The destination IP address (IPv4), so the length is 4
- The next-hop IP address (IPv4), so the length is 4
- The number of bytes of the Flow
- The number of packets of the Flow
Therefore, the Template FlowSet will be composed of the following:
Claise Informational [Page 27]
Cisco Systems NetFlow Services Export Version 9 June 2003
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = 0 | Length = 28 bytes |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID 256 | Field Count = 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IP_SRC_ADDR = 0x0008 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IP_DST_ADDR = 0x000C | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IP_NEXT_HOP = 0x000F | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IN_PKTS = 0x0002 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IN_BYTES = 0x0001 | Field Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
10.3 Data FlowSet Example
In this example, we report the following three Flow records:
Src IP addr. | Dst IP addr. | Next Hop addr. | Packet | Bytes
| | | Number | Number
---------------------------------------------------------------
198.168.1.12 | 10.5.12.254 | 192.168.1.1 | 5009 | 5344385
192.168.1.27 | 10.5.12.23 | 192.168.1.1 | 748 | 388934
192.168.1.56 | 10.5.12.65 | 192.168.1.1 | 5 | 6534
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = 256 | Length = 64 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 198.168.1.12 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10.5.12.254 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 192.168.1.1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5009 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5344385 |
Claise Informational [Page 28]
Cisco Systems NetFlow Services Export Version 9 June 2003
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 192.168.1.27 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10.5.12.23 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 192.168.1.1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 748 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 388934 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 192.168.1.56 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10.5.12.65 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 192.168.1.1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 6534 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Note that padding was not necessary in this example.
10.4 Options Template FlowSet Example
Per line card (the Exporter being composed of two line cards), we
want to report the following Field Types:
- Total number of Export Packets
- Total number of exported Flows
The format of the Options Template FlowSet is as follows:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = 1 | Length = 24 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID 257 | Option Scope Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option Length = 8 | Scope 1 Field Type = 0x0003 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Field Length = 2 | TOTAL_EXP_PKTS_SENT = 41 |
Claise Informational [Page 29]
Cisco Systems NetFlow Services Export Version 9 June 2003
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 | TOTAL_FLOWS_EXP = 42 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Length = 4 | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
10.5 Data FlowSet with Options Data Records Example
In this example, we report the following two records:
Line Card ID | Export Packet| Export Flow
------------------------------------------
Line Card 1 | 345 | 10201
Line Card 2 | 690 | 20402
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = 257 | Length = 14 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 1 | 345 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 10201 | 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 2 | 690 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 20402 | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
11. References
[1] R. Presuhn et al, "Management Information Base (MIB) for the
Simple Network Management Protocol (SNMP)" RFC 3418, December 2002
[2] J. Postel, "User Datagram Protocol" RFC 768, August 1980
[3] "TRANSMISSION CONTROL PROTOCOL DARPA INTERNET PROGRAM PROTOCOL
SPECIFICATION" RFC 793, September 1981
[4] R. Stewart et al, "Stream Control Transmission Protocol" RFC
2960, October 2000
12. Authors
Claise Informational [Page 30]
Cisco Systems NetFlow Services Export Version 9 June 2003
This document was jointly written by Vamsidhar Valluri, Martin
Djernaes, Ganesh Sadasivan, and Benoit Claise.
13. Acknowledgments
I would like to thank Pritam Shah and Paul Kohler for their valuable
technical feedback.
Authors Addresses
Benoit Claise
Cisco Systems
De Kleetlaan 6a b1
1831 Diegem
Belgium
Phone: +32 2 704 5622
E-mail: bclaise@cisco.com
Ganesh Sadasivan
Cisco Systems, Inc.
3750 Cisco Way
San Jose, CA 95134
USA
Phone: +1 408 527-0251
E-mail: gsadasiv@cisco.com
Vamsi Valluri
Cisco Systems, Inc.
510 McCarthy Blvd.
San Jose, CA 95035
USA
Phone: +1 408 525-1835
E-mail: vvalluri@cisco.com
Martin Djernaes
Cisco Systems, Inc.
510 McCarthy Blvd.
San Jose, CA 95035
USA
Phone: +1 408 853-1676
E-mail: djernaes@cisco.com
Claise Informational [Page 31]
| PAFTECH AB 2003-2026 | 2026-04-23 08:56:05 |