Internet Draft Expiration: February 2004 Editor B. Claise Document: draft-claise-netflow-9-03.txt Cisco Systems Category: Informational August 2003 Cisco Systems NetFlow Services Export Version 9 Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsolete by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. Abstract This document specifies the implementation details of the latest version of the Cisco Systems NetFlow services export format, also known as the NetFlow version 9 format. This format provides network administrators with access to IP flows information in a flexible and extensible way. The distinguishing feature of this new NetFlow services export format, compared with previous formats, is that it is template based. The template is a collection of fields, with corresponding descriptions of their structures and their semantics. Conventions used in this document The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119. Table of Contents 1. Introduction..................................................2 1.1 Overview..................................................2 1.2 Applications..............................................2 2. Terminology...................................................4 2.1 Terminology Summary Table.................................6 3. NetFlow High-Level Picture on the Exporter....................6 3.1 The NetFlow Process on the Exporter.......................6 3.2 Flow Expiration...........................................6 3.3 Transport Protocol........................................7 4. Packet Layout.................................................7 5. Export Packet Format..........................................8 5.1 Header Format.............................................8 Cisco Systems NetFlow Services Export Version 9 August 2003 5.2 Template FlowSet Format...................................9 5.3 Data FlowSet Format......................................11 6. Options......................................................12 6.1 Options Template FlowSet Format..........................12 6.2 Options Data Record Format...............................14 7. Template Management..........................................15 8. Field Type Definitions.......................................17 9. The Collector Side...........................................21 10. Examples....................................................22 10.1 Packet Header Example...................................22 10.2 Template FlowSet Example................................22 10.3 Data FlowSet Example....................................23 10.4 Options Template FlowSet Example........................24 10.5 Data FlowSet with Options Data Records Example..........25 11. References..................................................25 12. Authors.....................................................26 13. Acknowledgments.............................................26 1. Introduction 1.1 Overview NetFlow services data can be used for a variety of purposes. A partial list is provided in the "Application" section. This paper specifies the most recent version of the NetFlow services flow record format known as version 9. The distinguishing feature of the NetFlow version 9 format, compared with previous formats, is that it is template based. A template is a collection of fields with corresponding descriptions of their structures and their semantics. The template-based approach provides the following advantages: - New fields can be added to NetFlow flow records without changing the structure of the export record format. With previous NetFlow versions, adding a new field in the flow record implied a new version of the export protocol format and a new version of the NetFlow collector that supported the parsing of the new export protocol format. - Templates that are sent to the collector contain the structural information about the exported flow record fields. Therefore, if the collector does not understand the semantics of new fields, it can still interpret the flow record. - Because the template mechanism is flexible, it allows the export of only the required fields from the flows to the NetFlow collector. This helps to reduce the exported flow data volume and provides possible memory savings for the exporter and collector. Sending only the required information can also reduce network load. 1.2 Applications NetFlow services data enables several critical customer applications: Claise, et al. Informational [Page 2] Cisco Systems NetFlow Services Export Version 9 August 2003 Accounting and Billing NetFlow services data provides fine-grained metering (for example, flow records include details such as IP addresses, packet and byte counts, timestamps, Type of Service (ToS), application ports, etc.) for highly flexible and detailed resource usage accounting. ISPs can use this information to migrate from single fee, flat-rate billing to more flexible charging mechanisms based on time of day, bandwidth usage, application usage, quality of service, etc. Enterprise customers can use this information for departmental chargeback or cost allocation for resource usage. Network Planning NetFlow services data captured over a long period of time can be used to track and anticipate network growth and plan upgrades to increase the number of routing devices, ports, or higher-bandwidth interfaces. NetFlow services data optimizes both strategic network planning (peering, backbone upgrade planning, and routing policy planning) as well as tactical network engineering decisions (upgrading the router or link capacity). This helps to minimize the total cost of network operations while maximizing network performance, capacity, and reliability. Peering Agreements NetFlow services data enables ISP peering partners to measure the volume and characteristics of traffic exchanged with other ISP peers. Traffic Engineering NetFlow services data provides traffic engineering details for a set of prefixes. This data can be used in network optimization for load balancing traffic across alternate paths, or for forwarding traffic of a certain set of prefixes on a preferred route. Network Monitoring NetFlow services data enables extensive near real-time network monitoring capabilities. NetFlow services data analysis can be used to display traffic patterns associated with routing devices and switches on an individual or network-wide basis. This can display traffic- or application-based views and therefore help with proactive problem detection, efficient troubleshooting, and rapid problem resolution. Application Monitoring and Profiling NetFlow services data enables content and service providers to view detailed, time-based, and application-based usage of a network. This information allows planning and allocation of network and application resources such as Web server, gaming, or multimedia. User Monitoring and Profiling NetFlow services data provides a detailed understanding of customer or end-user usage of network and application resources. This information can then be used to efficiently plan and allocate Claise, et al. Informational [Page 3] Cisco Systems NetFlow Services Export Version 9 August 2003 access, backbone, and application resources, as well as to detect and resolve potential security and policy violations. Security Analysis NetFlow services data provides details on source and destination addresses, along with the start times of flows and application ports. This data can be used to analyze network security and identify network attacks. NetFlow Data Warehousing and Mining NetFlow services data (or derived information) can be stored for later retrieval and analysis to support proactive marketing and customer service programs. An example of this would be to determine which applications and services are being used by internal and external users and then target them for improved service such as advertising. This is especially useful for ISPs because NetFlow services data enables them to create better service packaging. 2. Terminology Various terms used in this document are described in this section. Note that the terminology summary table in Section 2.1 gives a quick overview of the relationships between some of the different terms defined. Observation Point An Observation Point is a location in the network where IP packets can be observed; for example, one or a set of interfaces on a network device like a router. Every Observation Point is associated with an Observation Domain. Observation Domain The set of Observation Points that is the largest aggregatable set of flow information at the network device with NetFlow services enabled is termed an Observation Domain. For example, a router line card composed of several interfaces with each interface being an Observation Point. IP Flow or Flow An IP Flow, also called a Flow, is defined as a set of IP packets passing an Observation Point in the network during a certain time interval. All packets that belong to a particular Flow have a set of common properties derived from the data contained in the packet and from the packet treatment at the Observation Point. Flow Record A Flow Record provides information about an IP Flow observed at an Observation Point. In this document, the Flow Data Records are also referred to as NetFlow services data and NetFlow data. Exporter A device (for example, a router) with the NetFlow services enabled, the Exporter monitors packets entering an Observation Point and Claise, et al. Informational [Page 4] Cisco Systems NetFlow Services Export Version 9 August 2003 creates Flows from these packets. The information from these Flows is exported in the form of Flow Records to the NetFlow Collector. NetFlow Collector The NetFlow Collector receives Flow Records from one or more Exporters. It processes the received Export Packet(s); that is, it parses and stores the Flow Record information. Flow Records can be optionally aggregated before being stored on the hard disk. The NetFlow Collector is also referred to as the Collector in this document. Export Packet An Export Packet is a packet originating at the Exporter that carries the Flow Records of this Exporter and whose destination is the NetFlow Collector. Packet Header The Packet Header is the first part of an Export Packet. The Packet Header provides basic information about the packet such as the NetFlow version, number of records contained within the packet, and sequence numbering. Template Record A Template Record defines the structure and interpretation of fields in a Flow Data Record. Flow Data Record A Flow Data Record is a data record that contains values of the Flow parameters corresponding to a Template Record. Options Template Record An Options Template Record defines the structure and interpretation of fields in an Options Data Record, including defining how to scope the applicability of the Options Data Record. Options Data Record The data record that contains values and scope information of the Flow measurement parameters, corresponding to an Options Template Record. FlowSet FlowSet is a generic term for a collection of Flow Records that have a similar structure. In an Export Packet, one or more FlowSets follow the Packet Header. There are three different types of FlowSets: Template FlowSet, Options Template FlowSet, and Data FlowSet. Template FlowSet A Template FlowSet is one or more Template Records that have been grouped together in an Export Packet. Options Template FlowSet Claise, et al. Informational [Page 5] Cisco Systems NetFlow Services Export Version 9 August 2003 An Options Template FlowSet is one or more Options Template Records that have been grouped together in an Export Packet. Data FlowSet A Data FlowSet is one or more records, of the same type, that are grouped together in an Export Packet. Each record is either a Flow Data Record or an Options Data Record previously defined by a Template Record or an Options Template Record. 2.1 Terminology Summary Table FlowSet Template Record Data Record +----------------------------------------------------------------+ | | | Flow Data Record(s) | | Data FlowSet | / | or | | | | Options Data Record(s) | +----------------------------------------------------------------+ | Template FlowSet | Template Record(s) | / | +----------------------------------------------------------------+ | Options Template | Options Template | / | | FlowSet | Record(s) | | +----------------------------------------------------------------+ A Data FlowSet is composed of an Options Data Record(s) or Flow Data Record(s). No Template Record is included. A Template Record defines the Flow Data Record, and an Options Template Record defines the Options Data Record. A Template FlowSet is composed of Template Record(s). No Flow or Options Data Record is included. An Options Template FlowSet is composed of Options Template Record(s). No Flow or Options Data Record is included. 3. NetFlow High-Level Picture on the Exporter 3.1 The NetFlow Process on the Exporter The NetFlow process on the Exporter is responsible for the creation of Flows from the observed IP packets. The details of this process are beyond the scope of this document. 3.2 Flow Expiration A Flow is considered to be inactive if no packets belonging to the Flow have been observed at the Observation Point for a given timeout. If any packet is seen within the timeout, the flow is considered an active flow. A Flow can be exported under the following conditions: 1. If the Exporter can detect the end of a Flow. For example, if the FIN or RST bit is detected in a TCP [3] connection, the Flow Record is exported. Claise, et al. Informational [Page 6] Cisco Systems NetFlow Services Export Version 9 August 2003 2. If the Flow has been inactive for a certain period of time. This inactivity timeout SHOULD be configurable, with a minimum value of 0 for an immediate expiration. 3. For long-lasting Flows, the Exporter SHOULD export the Flow Records on a regular basis. This timeout SHOULD be configurable. 4. If the Exporter experiences internal constraints, a Flow MAY be forced to expire prematurely; for example, counters wrapping or low memory. 3.3 Transport Protocol To achieve efficiency in terms of processing at the Exporter while handling high volumes of Export Packets, the NetFlow Export Packets are encapsulated into UDP [2] datagrams for export to the NetFlow Collector. However, NetFlow version 9 has been designed to be transport protocol independent. Hence, it can also operate over congestion-aware protocols such as TCP [3] or SCTP [4]. Note that the Exporter can export to multiple Collectors, using independent transport protocols. 4. Packet Layout An Export Packet consists of a Packet Header followed by one or more FlowSets. The FlowSets can be any of the possible three types: Template, Data, or Options Template. Export Packet: +--------+-------------------------------------------+ | | +----------+ +---------+ +----------+ | | Packet | | Template | | Data | | Options | | | Header | | FlowSet | | FlowSet | | Template | ... | | | | | | | | FlowSet | | | | +----------+ +---------+ +----------+ | +--------+-------------------------------------------+ A FlowSet ID is used to distinguish the different types of FlowSets. FlowSet IDs lower than 256 are reserved for special FlowSets, such as the Template FlowSet (ID 0) and the Options Template FlowSet (ID 1). The Data FlowSets will have a FlowSet ID greater than 255. The format of the Template, Data, and Options Template FlowSets will be discussed later in this document. All fields of the different FlowSets MUST be coded in network byte order (big- endian). Following are some examples of export packets: Claise, et al. Informational [Page 7] Cisco Systems NetFlow Services Export Version 9 August 2003 1. An Export Packet consisting of interleaved Template, Data, and Options Template FlowSets-A newly created Template is exported as soon as possible. So if there is already an Export Packet with a Data FlowSet that is being prepared for export, the Template and Option FlowSets are also interleaved with this information, subject to availability of space. Export Packet: +--------+--------------------------------------------------------+ | | +----------+ +---------+ +-----------+ +---------+ | | Packet | | Template | | Data | | Options | | Data | | | Header | | FlowSet | | FlowSet | ... | Template | | FlowSet | | | | | | | | | FlowSet | | | | | | +----------+ +---------+ +-----------+ +---------+ | +--------+--------------------------------------------------------+ 2. An Export Packet consisting entirely of Data FlowSetsùAfter the appropriate Template Records have been defined and transmitted to the NetFlow Collector device, the majority of Export Packets will consist solely of Data FlowSets. Export Packet: +--------+----------------------------------------------+ | | +---------+ +---------+ +---------+ | | Packet | | Data | ... | Data | ... | Data | | | Header | | FlowSet | ... | FlowSet | ... | FlowSet | | | | +---------+ +---------+ +---------+ | +--------+----------------------------------------------+ 3. An Export Packet consisting entirely of Template and Options Template FlowSetsùThe Exporter MAY transmit a packet containing Template and Options Template FlowSets periodically to help ensure that the NetFlow Collector has the correct Template Records and Options Template Records when the corresponding Flow Data records are received. Export Packet: +--------+-------------------------------------------------+ | | +----------+ +----------+ +----------+ | | Packet | | Template | | Template | | Options | | | Header | | FlowSet | ... | FlowSet | ... | Template | | | | | | | | | FlowSet | | | | +----------+ +----------+ +----------+ | +--------+-------------------------------------------------+ 5. Export Packet Format 5.1 Header Format The Packet Header format in this version is the same as that defined in the previous versions. Claise, et al. Informational [Page 8] Cisco Systems NetFlow Services Export Version 9 August 2003 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Version Number | Count | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | sysUpTime | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | UNIX Secs | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Sequence Number | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Source ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Packet Header Field Descriptions Version Version of Flow Record format exported in this packet. The value of this field is 9 for the current version. Count The total number of records in the Export Packet, which is the sum of Options FlowSet records, Template FlowSet records, and Data FlowSet records. SysUpTime Time in milliseconds since this device was first booted. Refer to [1]. UNIX Secs Seconds since 0000 UTC 1970. Sequence Number Incremental sequence counter of all Export Packets sent from the current Observation Domain by the Exporter. This value will be cumulative, and can be used to identify whether any Export Packets have been missed. Source ID A 32-bit value that identifies the Exporter Observation Domain. NetFlow Collectors SHOULD use the combination of the source IP address and the Source ID field to separate different export streams originating from the same Exporter. 5.2 Template FlowSet Format One of the essential elements in the NetFlow format is the Template FlowSet. Templates greatly enhance the flexibility of the Flow Record format because they allow the NetFlow Collector to process Flow Records without necessarily knowing the interpretation of all the data in the Flow Record. The format of the Template FlowSet is as follows: Claise, et al. Informational [Page 9] Cisco Systems NetFlow Services Export Version 9 August 2003 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | FlowSet ID = 0 | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID 1 | Field Count | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Type 1 | Field Length 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Type 2 | Field Length 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Type N | Field Length N | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID 2 | Field Count | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Type 1 | Field Length 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Type 2 | Field Length 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Type M | Field Length M | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID K | Field Count | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Template FlowSet Field Descriptions FlowSet ID FlowSet ID value of 0 is reserved for the Template FlowSet. Length Total length of this FlowSet. Because an individual Template FlowSet MAY contain multiple Template Records, the Length value MUST be used to determine the position of the next FlowSet record, which could be any type of FlowSet. Length is the sum of the lengths of the FlowSet ID, the Length itself, and all Template Records within this FlowSet. Template ID Each of the newly generated Template Records is given a unique Template ID. This uniqueness is local to the Observation Domain that generated the Template ID. Claise, et al. Informational [Page 10] Cisco Systems NetFlow Services Export Version 9 August 2003 Template IDs 0-255 are reserved for Template FlowSets, Options FlowSets, and other reserved FlowSets yet to be created. Template IDs of Data FlowSets are numbered from 256 to 65535. Field Count Number of fields in this Template Record. Because a Template FlowSet usually contains multiple Template Records, this field allows the Collector to determine the end of the current Template Record and the start of the next. Field Type A numeric value that represents the type of the field. Refer to the "Field Type Definitions" section. Field Length The length of the corresponding Field Type, in bytes. Refer to the "Field Type Definitions" section. 5.3 Data FlowSet Format The format of the Data FlowSet is as follows: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | FlowSet ID = Template ID | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Record 1 - Field Value 1 | Record 1 - Field Value 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Record 1 - Field Value 3 | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Record 2 - Field Value 1 | Record 2 - Field Value 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Record 2 - Field Value 3 | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Record 3 - Field Value 1 | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | Padding | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Data FlowSet Field Descriptions FlowSet ID = Template ID Each Data FlowSet is associated with a FlowSet ID. The FlowSet ID maps to a (previously generated) Template ID. The Collector MUST use the FlowSet ID to find the corresponding Template Record and decode the Flow Records from the FlowSet. Length Claise, et al. Informational [Page 11] Cisco Systems NetFlow Services Export Version 9 August 2003 The length of this FlowSet. Length is the sum of the lengths of the FlowSet ID, Length itself, all Flow Records within this FlowSet, and the padding bytes, if any. Record N - Field Value M The remainder of the Data FlowSet is a collection of Flow Data Record(s), each containing a set of field values. The Type and Length of the fields have been previously defined in the Template Record referenced by the FlowSet ID or Template ID. Padding Padding SHOULD be inserted so that the subsequent FlowSet starts at a 4-byte aligned boundary. It is important to note that the Length field includes the padding bits. Interpretation of the Data FlowSet format can be done only if the Template FlowSet corresponding to the Template ID is available at the Collector. 6. Options 6.1 Options Template FlowSet Format The Options Template Record (and its corresponding Options Data Record) is used to supply information about the NetFlow process configuration or NetFlow process specific data, rather than supplying information about IP Flows. For example, the Options Template FlowSet can report the sample rate of a specific interface, if sampling is supported, along with the sampling method used. The format of the Options Template FlowSet follows. Claise, et al. Informational [Page 12] Cisco Systems NetFlow Services Export Version 9 August 2003 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | FlowSet ID = 1 | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID | Option Scope Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Option Length | Scope 1 Field Type | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope 1 Field Length | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope N Field Length | Option 1 Field Type | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Option 1 Field Length | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Option M Field Length | Padding | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Options Template FlowSet Field Definitions FlowSet ID = 1 A FlowSet ID value of 1 is reserved for the Options Template. Length Total length of this FlowSet. Each Options Template FlowSet MAY contain multiple Options Template Records. Thus, the Length value MUST be used to determine the position of the next FlowSet record, which could be either a Template FlowSet or Data FlowSet. Length is the sum of the lengths of the FlowSet ID, the Length itself, and all Options Template Records within this FlowSet Template ID. Template ID Template ID of this Options Template. This value is greater than 255. Option Scope Length The length in bytes of any Scope field definition contained in the Options Template Record (The use of "Scope" is described below). Option Length The length (in bytes) of any options field definitions contained in this Options Template Record. Scope 1 Field Type The relevant portion of the Exporter/NetFlow process to which the Options Template Record refers. Currently defined values are: 1 System Claise, et al. Informational [Page 13] Cisco Systems NetFlow Services Export Version 9 August 2003 2 Interface 3 Line Card 4 Cache 5 Template For example, the NetFlow process can be implemented on a per-interface basis, so if the Options Template Record were reporting on how the NetFlow process is configured, the Scope for the report would be 2 (interface). The associated interface ID would then be carried in the associated Options Data FlowSet. The Scope can be limited further by listing multiple scopes that all must match at the same time. Note that the Scope fields always precede the Option fields. Scope 1 Field Length The length (in bytes) of the Scope field, as it would appear in an Options Data Record. Option 1 Field Type A numeric value that represents the type of field that would appear in the Options Template Record. Refer to the Field Type Definitions section. Option 1 Field Length The length (in bytes) of the Option field. Padding Padding SHOULD be inserted so that the subsequent FlowSet starts at a 4-byte aligned boundary. It is important to note that the Length field includes the padding bits. 6.2 Options Data Record Format The Options Data Records are sent in Data FlowSets, on a regular basis, but not with every Flow Data Record. How frequently these Options Data Records are exported is configurable. See the "Templates Management" section for more details. The format of the Data FlowSet containing Options Data Records follows. Claise, et al. Informational [Page 14] Cisco Systems NetFlow Services Export Version 9 August 2003 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | FlowSet ID = Template ID | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Record 1 - Scope 1 Value |Record 1 - Option Field 1 Value| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |Record 1 - Option Field 2 Value| ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Record 2 - Scope 1 Value |Record 2 - Option Field 1 Value| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |Record 2 - Option Field 2 Value| ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Record 3 - Scope 1 Value |Record 3 - Option Field 1 Value| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |Record 3 - Option Field 2 Value| ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | Padding | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Options Data Records of the Data FlowSet Field Descriptions FlowSet ID = Template ID A FlowSet ID precedes each group of Options Data Records within a Data FlowSet. The FlowSet ID maps to a previously generated Template ID corresponding to this Options Template Record. The Collector MUST use the FlowSet ID to map the appropriate type and length to any field values that follow. Length The length of this FlowSet. Length is the sum of the lengths of the FlowSet ID, Length itself, all the Options Data Records within this FlowSet, and the padding bytes, if any. Record N - Option Field M Value The remainder of the Data FlowSet is a collection of Flow Records, each containing a set of scope and field values. The type and length of the fields were previously defined in the Options Template Record referenced by the FlowSet ID or Template ID. Padding Padding SHOULD be inserted so that the subsequent FlowSet starts at a 4-byte aligned boundary. It is important to note that the Length field includes the padding bits. The Data FlowSet format can be interpreted only if the Options Template FlowSet corresponding to the Template ID is available at the Collector. 7. Template Management Claise, et al. Informational [Page 15] Cisco Systems NetFlow Services Export Version 9 August 2003 Flow Data records that correspond to a Template Record MAY appear in the same and/or subsequent Export Packets. The Template Record is not necessarily carried in every Export Packet. As such, the NetFlow Collector MUST store the Template Record to interpret the corresponding Flow Data Records that are received in subsequent data packets. A NetFlow Collector that receives Export Packets from several Observation Domains from the same Exporter MUST be aware that the uniqueness of the Template ID is not guaranteed across Observation Domains. The Template IDs must remain constant for the life of the NetFlow process on the Exporter. If the Exporter or the NetFlow process restarts for any reason, all information about Templates will be lost and new Template IDs will be created. Template IDs are thus not guaranteed to be consistent across an Exporter or NetFlow process restart. A newly created Template record is assigned an unused Template ID from the Exporter. If the template configuration is changed, the current Template ID is abandoned and SHOULD NOT be reused until the NetFlow process or Exporter restarts. If a Collector should receive a new definition for an already existing Template ID, it MUST discard the previous template definition and use the new one. If a configured Template Record on the Exporter is deleted, and re- configured with exactly the same parameters, the same Template ID COULD be reused. The Exporter sends the Template FlowSet and Options Template FlowSet under the following conditions: 1. After a NetFlow process restarts, the Exporter MUST NOT send any Data FlowSet without sending the corresponding Template FlowSet and the required Options Template FlowSet in a previous packet or including it in the same Export Packet. It MAY transmit the Template FlowSet and Options Template FlowSet, without any Data FlowSets, in advance to help ensure that the Collector will have the correct Template Record before receiving the first Flow or Options Data Record. 2. In the event of configuration changes, the Exporter SHOULD send the new template definitions at an accelerated rate. In such a case, it MAY transmit the changed Template Record(s) and Options Template Record(s), without any data, in advance to help ensure that the Collector will have the correct template information before receiving the first data. 3. On a regular basis, the Exporter MUST send all the Template Records and Options Template Records to refresh the Collector. Claise, et al. Informational [Page 16] Cisco Systems NetFlow Services Export Version 9 August 2003 Template IDs have a limited lifetime at the Collector and MUST be periodically refreshed. Two approaches are taken to make sure that Templates get refreshed at the Collector: * Every N number of Export Packets. * On a time basis, so every N number of minutes. Both options MUST be configurable by the user. When one of these expiry conditions is met, the Exporter MUST send the Template FlowSet and Options Template. 8. Field Type Definitions The following table describes all the field type definitions that an Exporter MAY support. The fields are a selection of Packet Header fields, lookup results (for example, the autonomous system numbers or the subnet masks), and properties of the packet such as length. Field Type Value Length Description (bytes) Incoming counter with length IN_BYTES 1 N N x 8 bits for bytes associated with an IP Flow Incoming counter with length IN_PKTS 2 N N x 8 bits for packets associated with an IP Flow FLOWS 3 N Number of Flows that were aggregated; by default N is 4 PROTOCOL 4 1 IP protocol byte TOS 5 1 Type of service byte TCP_FLAGS 6 1 TCP flags; cumulative of all the TCP flags seen in this Flow TCP/UDP source port number L4_SRC_PORT 7 2 (for example, FTP, Telnet, or equivalent) IPV4_SRC_ADDR 8 4 IPv4 source address SRC_MASK 9 1 Source route mask bits Input interface index. INPUT_SNMP 10 N By default N is 2, but higher values can be used Claise, et al. Informational [Page 17] Cisco Systems NetFlow Services Export Version 9 August 2003 TCP/UDP destination port L4_DST_PORT 11 2 number (for example, FTP, Telnet, or equivalent) IPV4_DST_ADDR 12 4 IPv4 destination address DST_MASK 13 1 Destination route mask bits Output interface index. OUTPUT_SNMP 14 N By default N is 2, but higher values can be used IPV4_NEXT_HOP 15 4 IPv4 address of the next-hop router Source BGP autonomous SRC_AS 16 N system number where N could be 2 or 4 Destination BGP autonomous DST_AS 17 N system number where N could be 2 or 4 BGP_IPV4_NEXT_HOP 18 4 Next-hop router's IP address in the BGP domain IP multicast outgoing MUL_DST_PKTS 19 N packet counter with length N x 8 bits for packets associated with the IP Flow IP multicast outgoing MUL_DST_BYTES 20 N Octet (byte) counter with length N x 8 bits for bytes associated with the IP Flow SysUptime at which the LAST_SWITCHED 21 4 last packet of this Flow was switched SysUptime at which the FIRST_SWITCHED 22 4 first packet of this Flow was switched IPV6_SRC_ADDR 27 16 IPv6 source address IPV6_DST_ADDR 28 16 IPv6 destination address IPV6_SRC_MASK 29 1 Length of the IPv6 source mask in contiguous bits Claise, et al. Informational [Page 18] Cisco Systems NetFlow Services Export Version 9 August 2003 IPV6_DST_MASK 30 1 Length of the IPv6 destination mask in contiguous bits Flow identifier for a given FLOW_LABEL 31 3 source/destination pair of IPv6 traffic Internet Control Message ICMP_TYPE 32 2 Protocol (ICMP) packet type; reported as ICMP Type * 256 + ICMP code IGMP_TYPE 33 1 Internet Group Management Protocol (IGMP) packet type When using sampled NetFlow, the rate at which packets SAMPLING_INTERVAL 34 4 are sampled; for example, a value of 100 indicates that one of every hundred packets is sampled The type of algorithm used for sampled NetFlow: SAMPLING_ALGO 35 1 1 interval packet sampling 2 pseudorandom sampling Timeout value (in seconds) FLOW_ACTIVE_TIMEOUT 36 2 for active Flow entries in the NetFlow cache Timeout value (in seconds) FLOW_INACTIVE_TIMEOUT 37 2 for inactive Flow entries in the NetFlow cache ENGINE_TYPE 38 1 Type of Flow switching engine ENGINE_ID 39 1 ID number of the Flow switching engine Counter with length N x 8 bits for bytes TOTAL_BYTES_EXPORTED 40 N for the number of bytes exported by the Observation Domain Counter with length N x 8 bits for bytes Claise, et al. Informational [Page 19] Cisco Systems NetFlow Services Export Version 9 August 2003 TOTAL_EXP_PKTS_SENT 41 N for the number of packets exported by the Observation Domain Counter with length N x 8 bits for bytes TOTAL_FLOWS_EXP 42 N for the number of Flows exported by the Observation Domain Internet Protocol Version Set to 4 for IPv4, set to 6 IP_PROTOCOL_VERSION 60 1 for IPv6. If not present in the template, then version 4 is assumed Flow direction: DIRECTION 61 1 0 - ingress flow 1 û egress flow IPV6_NEXT_HOP 62 16 IPv6 address of the next-hop router BPG_IPV6_NEXT_HOP 63 16 Next-hop router in the BGP domain Bit-encoded field IPV6_OPTION_HEADERS 64 4 identifying IPv6 option headers found in the flow MPLS_LABEL_1 70 3 MPLS label at position 1 in the stack MPLS_LABEL_2 71 3 MPLS label at position 2 in the stack MPLS_LABEL_3 72 3 MPLS label at position 3 in the stack MPLS_LABEL_4 73 3 MPLS label at position 4 in the stack MPLS_LABEL_5 74 3 MPLS label at position 5 in the stack MPLS_LABEL_6 75 3 MPLS label at position 6 in the stack MPLS_LABEL_7 76 3 MPLS label at position 7 in the stack MPLS_LABEL_8 77 3 MPLS label at position 8 in Claise, et al. Informational [Page 20] Cisco Systems NetFlow Services Export Version 9 August 2003 the stack MPLS_LABEL_9 78 3 MPLS label at position 9 in the stack MPLS_LABEL_10 79 3 MPLS label at position 10 in the stack The value field is a numeric identifier for the field type. The following value fields are reserved for Cisco proprietary field types: 23 to 26, 43 to 59, and 65 to 69. When extensibility is required, the new field types will be added to the list. The new field types have to be updated on the Exporter and Collector but the NetFlow export format would remain unchanged. Refer to the latest documentation at http://www.cisco.com for the newly updated list. All counters and counter-like objects are unsigned integers. In some cases the optimum size of the counter is implementation dependent. In these cases the field types are specified as objects of size N bytes, which should be interpreted as unsigned integers of size N. 9. The Collector Side The Collector will receive Template Records from the Exporter, normally before receiving Flow Data Records (or Options Data Records). The Flow Data Records (or Options Data Records) can then be decoded and stored locally on the devices. If the Template Records have not been received at the time Flow Data Records (or Options Data Records) are received, the Collector SHOULD store the Flow Data Records (or Options Data Records) and decode them after the Template Records are received. A Collector device MUST NOT assume that the Data FlowSet and the associated Template FlowSet (or Options Template FlowSet) are exported in the same Export Packet. The Collector MUST NOT assume that one and only one Template FlowSet is present in an Export Packet. The life of a template at the Collector is limited to a fixed refresh timeout. Templates not refreshed from the Exporter within the timeout are expired at the Collector. The Collector MUST NOT attempt to decode the Flow or Options Data Records with an expired Template. At any given time the Collector SHOULD maintain the following for all the current Template Records and Options Template Records: Exporter, Observation Domain, Template ID, Template Definition, Last Received. Note that the Observation Domain is identified by the Source ID field from the Export Packet. Template IDs are unique per Exporter and per Observation Domain. Claise, et al. Informational [Page 21] Cisco Systems NetFlow Services Export Version 9 August 2003 If the Collector receives a new Template Record (for example, in the case of an Exporter restart) it MUST immediately override the existing Template Record. 10. Examples Let us consider the example of an Export Packet composed of a Template FlowSet, a Data FlowSet (which contains three Flow Data Records), an Options Template FlowSet, and a Data FlowSet (which contains two Options Data Records). Export Packet: +--------+---------------------------------------------. . . | | +--------------+ +-----------------------+ | Packet | | Template | | Data | | Header | | FlowSet | | FlowSet | . . . | | | (1 Template) | | (3 Flow Data Records) | | | +--------------+ +-----------------------+ +--------+---------------------------------------------. . . . . .+-------------------------------------------------+ +------------------+ +--------------------------+ | | Options | | Data | | . . .| Template FlowSet | | FlowSet | | | (1 Template) | | (2 Options Data Records) | | +------------------+ +--------------------------+ | . . .--------------------------------------------------+ 10.1 Packet Header Example The Packet Header is composed of: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Version = 9 | Count = 7 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | sysUpTime | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | UNIX Secs | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Sequence Number | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Source ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 10.2 Template FlowSet Example We want to report the following Field Types: - The source IP address (IPv4), so the length is 4 - The destination IP address (IPv4), so the length is 4 - The next-hop IP address (IPv4), so the length is 4 Claise, et al. Informational [Page 22] Cisco Systems NetFlow Services Export Version 9 August 2003 - The number of bytes of the Flow - The number of packets of the Flow Therefore, the Template FlowSet will be composed of the following: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | FlowSet ID = 0 | Length = 28 bytes | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID 256 | Field Count = 5 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IP_SRC_ADDR = 8 | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IP_DST_ADDR = 12 | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IP_NEXT_HOP = 15 | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IN_PKTS = 2 | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IN_BYTES = 1 | Field Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 10.3 Data FlowSet Example In this example, we report the following three Flow Records: Src IP addr. | Dst IP addr. | Next Hop addr. | Packet | Bytes | | | Number | Number --------------------------------------------------------------- 198.168.1.12 | 10.5.12.254 | 192.168.1.1 | 5009 | 5344385 192.168.1.27 | 10.5.12.23 | 192.168.1.1 | 748 | 388934 192.168.1.56 | 10.5.12.65 | 192.168.1.1 | 5 | 6534 Claise, et al. Informational [Page 23] Cisco Systems NetFlow Services Export Version 9 August 2003 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | FlowSet ID = 256 | Length = 64 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 198.168.1.12 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 10.5.12.254 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.168.1.1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 5009 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 5344385 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.168.1.27 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 10.5.12.23 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.168.1.1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 748 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 388934 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.168.1.56 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 10.5.12.65 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 192.168.1.1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 5 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 6534 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Note that padding was not necessary in this example. 10.4 Options Template FlowSet Example Per line card (the Exporter is composed of two line cards), we want to report the following Field Types: - Total number of Export Packets - Total number of exported Flows The format of the Options Template FlowSet is as follows: Claise, et al. Informational [Page 24] Cisco Systems NetFlow Services Export Version 9 August 2003 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | FlowSet ID = 1 | Length = 24 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Template ID 257 | Option Scope Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Option Length = 8 | Scope 1 Field Type = 3 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Scope 1 Field Length = 2 | TOTAL_EXP_PKTS_SENT = 41 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 4 | TOTAL_FLOWS_EXP = 42 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Field Length = 4 | Padding | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 10.5 Data FlowSet with Options Data Records Example In this example, we report the following two records: Line Card ID | Export Packet| Export Flow ------------------------------------------ Line Card 1 | 345 | 10201 Line Card 2 | 690 | 20402 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | FlowSet ID = 257 | Length = 14 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 1 | 345 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 10201 | 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 2 | 690 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 20402 | Padding | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 11. References [1] R. Presuhn et al, "Management Information Base (MIB) for the Simple Network Management Protocol (SNMP)" RFC 3418, December 2002 [2] J. Postel, "User Datagram Protocol" RFC 768, August 1980 [3] "TRANSMISSION CONTROL PROTOCOL DARPA INTERNET PROGRAM PROTOCOL SPECIFICATION" RFC 793, September 1981 [4] R. Stewart et al, "Stream Control Transmission Protocol" RFC 2960, October 2000 Claise, et al. Informational [Page 25] Cisco Systems NetFlow Services Export Version 9 August 2003 12. Authors This document was jointly written by Vamsidhar Valluri, Martin Djernaes, Ganesh Sadasivan, and Benoit Claise. 13. Acknowledgments I would like to thank Pritam Shah, Paul Kohler and Stewart Bryant for their valuable technical feedback. Authors Addresses Benoit Claise Cisco Systems De Kleetlaan 6a b1 1831 Diegem Belgium Phone: +32 2 704 5622 E-mail: bclaise@cisco.com Ganesh Sadasivan Cisco Systems, Inc. 3750 Cisco Way San Jose, CA 95134 USA Phone: +1 408 527-0251 E-mail: gsadasiv@cisco.com Vamsi Valluri Cisco Systems, Inc. 510 McCarthy Blvd. San Jose, CA 95035 USA Phone: +1 408 525-1835 E-mail: vvalluri@cisco.com Martin Djernaes Cisco Systems, Inc. 510 McCarthy Blvd. San Jose, CA 95035 USA Phone: +1 408 853-1676 E-mail: djernaes@cisco.com Claise, et al. Informational [Page 26]