Cisco uBR10012 Software Configuration Manual page 116

Supported Software Features for the Cisco uBR10012 Router
NetFlow Version 5 Features and Format
NetFlow exports flow information in UDP datagrams in one of two formats. The version 1 format was
the initially released version, and version 5 is a later enhancement to add Border Gateway Protocol
(BGP) autonomous system (AS) information and flow sequence numbers.
In Netflow Version 1 and Version 5 formats, the datagram consists of a header and one or more flow
records. The first field of the header contain the version number of the export datagram. Typically, a
receiving application that accepts either format allocates a buffer big enough for the biggest possible
datagram from either format and uses the version from the header to determine how to interpret the
datagram. The second field in the header is the number of records in the datagram and should be used to
index through the records.
All fields in either version 1 or version 5 formats are in network byte order. Table 5 and Table 6 describe
the data format for version 1, and Table 7 and Table 8 describe the data format for version 5.
We recommend that receiving applications check datagrams to ensure that the datagrams are from a valid
NetFlow source. We recommend you first check the size of the datagram to make sure it is at least long
enough to contain the version and count fields. Next we recommend you verify that the version is valid
(1 or 5) and that the number of received bytes is enough for the header and count flow records (using the
appropriate version).
Because NetFlow export uses UDP to send export datagrams, it is possible for datagrams to be lost. To
determine whether or not flow export information is lost, the version 5 header format contains a flow
sequence number. The sequence number is equal to the sequence number of the previous plus the number
of flows in the previous datagram. After receiving a new datagram, the receiving application can subtract
the expected sequence number from the sequence number in the header to get the number of missed
flows.
Table 1-8
Table 1-8
Bytes
0-3
4-7
8-11
12-15
16-19
20-23
1. Netflow Version 5 export packets (set with ip flow-export command) allow the number of records stored in the datagram to
Table 1-9
Table 1-9
Bytes
0-3
4-7
8-11
Cisco uBR10012 Universal Broadband Router Software Configuration Guide
1-96
lists the byte definitions for Netflow Version 5 header format.
Netflow Version 5 Header Format
Content
version and count
SysUptime
unix_secs
unix_nsecs
flow_sequence
reserved
be a variable between 1 and 30.
lists the byte definitions for Version 5 flow record format.
Netflow Version 5 Flow Record Format
Content
srcaddr
dstaddr
nexthop
Chapter 1 Overview of Cisco uBR10012 Universal Broadband Router Software
Description
Netflow export format version number and number of flows
exported in this packet (1-30).
Current time in milliseconds since router booted
Current seconds since 0000 UTC 1970.
Residual nanoseconds since 0000 UTC 1970.
Sequence counter of total flows seen.
Unused (zero) bytes.
Description
Source IP address.
Destination IP address.
Next hop router's IP address.
1
OL-1520-05