Cisco WS-C6506 Software Manual page 525

Chapter 16 Configuring NDE
Table 16-2 NDE Version 5 Flow Record Format (continued)
Bytes Content Description
34–35 dstport Layer 4 destination port number
or equivalent
36 pad1 Unused (zero) byte
37 tcp_flags Cumulative OR of TCP flags
38 prot Layer 4 protocol
(for example, 6=TCP, 17=UDP)
39 tos IP type-of-service byte
40–41 src_as Autonomous system number of the source,
either origin or peer
42–43 dst_as Autonomous system number of the
destination, either origin or peer
44–45 src_mask Source address prefix mask bits
46–47 dst_mask Destination address prefix mask bits
48 pad2 Pad 2 is unused (zero) bytes
1. This flow mask is not configurable from the CLI. It is only turned on if certain features, such as reflexive ACLs, are set up.
2. This feature is not supported on Supervisor Engine 1 or 1A.
Table 16-3
Bytes
0–1
2–3
4–7
8–11
12–15
16–19
20–24
Table 16-4 NDE Version 7 Flow Record Format
Bytes Content Description
0–3 srcaddr Source IP address
4–7 dstaddr Destination IP address
8–11 nexthop Next-hop router's IP address
12–13 input Ingress interface SNMP ifIndex
OL-8978-04
NDE Version 7 Header Format
Content Description
version NetFlow export format version number
count Number of flows exported in this packet (1–30)
SysUptime Current time in milliseconds since router booted
unix_secs Current seconds since 0000 UTC 1970
unix_nsecs Residual nanoseconds since 0000 UTC 1970
flow_sequence Sequence counter of total flows seen
reserved Unused (zero) bytes
2
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
Flow masks: X=Populated
Destination
Destination Source
0 0
0 0
0 0
X X
0 0
0 0
0 0
0 0
Flow masks: X=Populated
Destination
Destination Source
0 X
X X
X X
0 X
Understanding How NDE Works
1
Full Full VLAN
X X
0 0
X X
X X
0 0
0 0
0 0
0 0
1
Full Full VLAN
X X
X X
X X
X X
16-5