Information Derived From Hardware - Cisco 4500M Software Manual

Chapter 40 Configuring NetFlow Statistics Collection
Table 40-2 NDE Version 5 Flow Record Format
Bytes Content Description
0–3 srcaddr Source IP address
4–7 dstaddr Destination IP address
8–11 nexthop Next hop router's IP address
12–13 input Ingress interface SNMP ifIndex
14–15 output Egress interface SNMP ifIndex
16–19 dPkts Packets in the flow
20–23 dOctets Octets (bytes) in the flow
24–27 first SysUptime at start of the flow
28–31 last SysUptime at the time the
last packet of the flow was received
32–33 srcport Layer 4 source port number or equivalent
34–35 dstport Layer 4 destination port number or equivalent
36 pad1 Unused (zero) byte
37 tcp_flags Cumulative OR of TCP flags
38 prot Layer 4 protocol
(for example, 6=TCP, 17=UDP)
39 tos IP type-of-service byte
40–41 src_as Autonomous system number of the source,
either origin or peer
42–43 dst_as Autonomous system number of the
destination, either origin or peer
44–45 src_mask Source address prefix mask bits
46–47 dst_mask Destination address prefix mask bits
48 pad2 Pad 2 is unused (zero) bytes
1. With the destination flow mask, the "Next hop router's IP address" field and the "Output interface's SNMP ifIndex" field might not contain information
that is accurate for all flows.
2. In PFC3BXL or PFC3B mode, ICMP traffic contains the ICMP code and type values.

Information Derived from Hardware

Information available in a typical NetFlow record from hardware includes the following:
•
•
OL-6696-01
the packet and byte counts
start and end timestamps
Overview of NetFlow Statistics Collection
Flow masks:
• X=Populated
• A=Additional field
X X
X X
1
A A
1
A A
X X X
X X X
X X X
X X X
X X
X X
X X
X X
Software Configuration Guide—Release 12.2(25)EW
X X X
X X X
A A A
X X
A A A
X X X
X X X
X X X
X X X
2 2
X X
X X
X X
X X X
X X X
X X X
X X X
40-3