Cisco 6500 Series Software Configuration Manual page 479

Chapter 33 Configuring NDE
Table 33-3 NDE Version 7 Header Format
Bytes
0–1
2–3
4–7
8–11
12–15
16–19
20–24
Table 33-4 NDE Version 7 Flow Record Format
Bytes Content Description
0–3 srcaddr Source IP address
4–7 dstaddr Destination IP address
8–11 nexthop Next hop router's IP address
12–13 input Ingress interface SNMP ifIndex
14–15 output Egress interface SNMP ifIndex
16–19 dPkts Packets in the flow
20–23 dOctets Octets (bytes) in the flow
24–27 First SysUptime at start of the flow
28–31 Last SysUptime at the time the
last packet of the flow was received
32–33 srcport Layer 4 source port number
or equivalent
34–35 dstport Layer 4 destination port number
or equivalent
36 flags flow mask in use
37 tcp_flags Cumulative OR of TCP flags
38 prot Layer 4 protocol
(for example, 6=TCP, 17=UDP)
39 tos IP type-of-service byte
40–41 src_as Autonomous system number of the
source, either origin or peer
78-14099-04
Content Description
version Netflow export format version number
count Number of flows exported in this packet (1–30)
SysUptime Current time in milliseconds since router booted
unix_secs Current seconds since 0000 UTC 1970
unix_nsecs Residual nanoseconds since 0000 UTC 1970
flow_sequence Sequence counter of total flows seen
reserved Unused (zero) bytes
Flow masks:
• X=Populated
• A=Additional field (see the
Fields" section on page
Destination
X
2
X
2
X
X
X
X
X
X
Catalyst 6500 Series Switch Cisco IOS Software Configuration Guide—Release 12.1 E
Understanding How NDE Works
"Populating Additional NDE
33-10)
Destination
Destination Source
1
Source Interface
X X
X X
X X
X
X X
X X
X X
X X
X X
X X
A A
Full
1
Full Interface
X X
X X
X X
X
X X
X X
X X
X X
X X
X X
X X
X X
X X
A A
33-5