Netflow Version 5 Record Format - Enterasys Matrix N1 Configuration Manual

NetFlow Version 5 Record Format

NetFlow Version 5 Record Format
Table 4 provides a listing and description for the NetFlow version 5 header fields and data record
format. The contents of these data fields are used by the collector software application for flow
analysis. Data fields are identified in the data record packet sent by the network switch to the
collector. The data records contain the values specified by the format.
Table 4 NetFlow Version 5 Template Header and Data Field Support
NetFlow Version 5 Header
Data Field
count
sys_uptime
unix_secs
unix_nsecs
flow_sequence
engine_type
engine_id
sampling_interval
count
NetFlow Version 5 Data Record Format
Data Field
srcaddr
dstaddr
nexthop
input
output
dPkts
dOctets
first
last
srcport
dstport
pad1
tcp_flags
February 26, 2008
Support
Number of flows exported in this packet (1-30).
Current time in milliseconds since the export
device booted.
Current count of seconds since 0000 UTC 1970.
Residual nanoseconds since 0000 UTC 1970.
Sequence counter of total flows seen.
Type of flow-switching engine.
Slot number of the flow-switching engine.
First two bits hold the sampling mode; remaining
14 bits hold value of sampling interval.
Number of flows exported in this packet (1-30).
Support
Source IP address of the device that transmitted
the packet.
IP address of the destination of the packet.
IP address of the next hop router.
SNMP index of input interface.
SNMP index of output interface.
Number of packets in the flow.
Total number of Layer 3 bytes in the packets of
the flow.
SysUptime at start of flow.
SysUptime at the time the last packet of the flow
was received.
TCP/UDP source port number or equivalent.
TCP/UDP destination port number or equivalent.
Unused (zero) bytes.
Cumulative OR of TCP flags.
Page 14 of 19