Type

Name

Description

Data Type

IPV4_DST_ADDR

IPv4 Destination address

IPv4 Destination address

uint32

FlowDateTime

Flow date and time

Date time of flow, generated by Exporter process

unixtime

BGP_IPV4_NEXT_HOP

BGP IPV4 next hop address

Next-hop router's IP in the BGP domain

uint32

BGP_IPV6_NEXT_HOP

BGP IPV6 next hop address

Next-hop router's IP in the BGP domain

ipv6

DIRECTION

Flow direction

Flow direction: 0 - ingress flow, 1 - egress flow

byte

DST_AS

Destination AS

Destination BGP autonomous system number

uint32

DST_MASK

Destination Mask

The number of contiguous bits in the destination address subnet mask i.e. the submask in slash notation

byte

DST_TOS

Destination TOS

Type of Service byte setting when exiting outgoing interface

byte

DST_VLAN

Destination VLAN

Virtual LAN identifier associated with egress interface

uint16

ENGINE_ID

Engine ID

ID number of the flow switching engine

byte

ENGINE_TYPE

Engine Type

Type of flow switching engine: RP = 0, VIP/Linecard = 1

byte

FIRST_SWITCHED

First switched

System uptime at which the first packet of this flow was switched

uint32

FLOW_ACTIVE_TIMEOUT

Flow active timeout

Timeout value (in seconds) for active flow entries in the NetFlow cache

uint16

FLOW_INACTIVE_TIMEOUT

Flow Inactive timeout

Timeout value (in seconds) for inactive flow entries in the NetFlow cache

uint16

FLOW_SAMPLER_ID

Flow sampler ID

Identifier shown in "show flow-sampler"

byte

FLOW_SAMPLER_MODE

Flow sampler mode

The type of algorithm used for sampling data: 0x02 random sampling. Use in connection with FLOW_SAMPLER_MODE

byte

FLOW_SAMPLER_RANDOM_INTERVAL

Flow sampler random interval

Packet interval at which to sample. Use in connection with FLOW_SAMPLER_MODE

uint32

FLOWS

Flows

Number of flows that were aggregated

uint32

FORWARDING_STATUS

Forwarding status

Forwarding status is encoded on 1 byte with the 2 left bits giving the status and the 6 remaining bits giving the reason code.

byte

FRAGMENT_OFFSET

Fragment offset

The fragment-offset value from fragmented IP packets

uint32

ICMP_TYPE

ICMP type

Internet Control Message Protocol (ICMP) packet type; reported as ((ICMP Type * 256) + ICMP code)

uint16

IF_DESC

Interface description

Full interface name e.g. "FastEthernet 1/0"

string

IF_NAME

Interface name

Shortened interface name e.g. "FE1/0"

string

IN_BYTES

Incoming Bytes

Incoming counter for number of bytes associated with an IP Flow.

uint64

IN_DST_MAC

Incoming destination MAC

Incoming destination MAC address

mac

IN_PERMANENT_BYTES

Incoming permanent bytes

Running byte counter for a permanent flow

uint64

IN_PERMANENT_PKTS

Incoming permanent packets

Running packet counter for a permanent flow

uint64

IN_PKTS

Incoming packets

Incoming counter for the number of packets associated with an IP Flow

uint64

IN_SRC_MAC

Incoming source MAC

Incoming source MAC address

mac

INPUT_SNMP

Input interface

Input interface index

uint32

IP_PROTOCOL_VERSION

IP protocol version

Internet Protocol Version Set to 4 for IPv4, set to 6 for IPv6. If not present in the template, then version 4 is assumed.

byte

IPV4_DST_PREFIX

IPv4 destination prefix

IPv4 destination address prefix (specific for Catalyst architecture)

uint32

IPV4_IDENT

IPv4 identification

The IP v4 identification field

uint16

IPV4_NEXT_HOP

IPv4 next hop address

IPv4 address of next-hop router

uint32

IPV4_SRC_ADDR

IPv4 source address

IPv4 source address

uint32

IPV4_SRC_PREFIX

IPv4 source prefix

IPv4 source address prefix (specific for Catalyst architecture)

uint32

IPV6_DST_ADDR

IPv6 destination address

IPv6 Destination Address

binary

IPV6_DST_MASK

IPv6 destination mask

Length of the IPv6 destination mask in contiguous bits

byte

IPV6_FLOW_LABEL

IPv6 flow label

IPv6 flow label as per RFC 2460 definition

uint32

IPV6_NEXT_HOP

IPv6 next hop address

IPv6 address of the next-hop router

ipv6

IPV6_OPTION_HEADERS

IPv6 option headers

Bit-encoded field identifying IPv6 option headers found in the flow

uint32

IPV6_SRC_ADDR

IPv6 source address

IPv6 Source Address

ipv6

IPV6_SRC_MASK

IPv6 source mask

Length of the IPv6 source mask in contiguous bits

byte

L4_DST_PORT

L4 destination port

TCP/UDP destination port number e.g. FTP, Telnet, or equivalent

uint16

L4_SRC_PORT

L4 source port

TCP/UDP source port number e.g. FTP, Telnet, or equivalent

uint16

LAST_SWITCHED

Last packet time

System uptime at which the last packet of this flow was switched

uint32

MAX_PKT_LNGTH

Maximum packet length

Maximum IP packet length on incoming packets of the flow

uint16

MAX_TTL

Maximum TTL

Maximum TTL on incoming packets of the flow

byte

MIN_PKT_LNGTH

Minimum packet length

Minimum IP packet length on incoming packets of the flow

uint16

MIN_TTL

Minimum TTL

Minimum TTL on incoming packets of the flow

byte

MPLS_LABEL_1

MPLS Label 1

MPLS label at position 1 in the stack

uint32

MPLS_LABEL_10

MPLS Label 10

MPLS label at position 10 in the stack

uint32

MPLS_LABEL_2

MPLS Label 2

MPLS label at position 2 in the stack

uint32

MPLS_LABEL_3

MPLS Label 3

MPLS label at position 3 in the stack

uint32

MPLS_LABEL_4

MPLS Label 4

MPLS label at position 4 in the stack

uint32

MPLS_LABEL_5

MPLS Label 5

MPLS label at position 5 in the stack

uint32

MPLS_LABEL_6

MPLS Label 6

MPLS label at position 6 in the stack

uint32

MPLS_LABEL_7

MPLS Label 7

MPLS label at position 7 in the stack

uint32

MPLS_LABEL_8

MPLS Label 8

MPLS label at position 8 in the stack

uint32

MPLS_LABEL_9

MPLS Label 9

MPLS label at position 9 in the stack

uint32

MPLS_TOP_LABEL_IP_ADDR

MPLS top label IP address

Forwarding Equivalent Class corresponding to the MPLS Top Label

uint32

MPLS_TOP_LABEL_TYPE

MPLS top label type

MPLS Top Label Type: 0x00 UNKNOWN 0x01 TE-MIDPT 0x02 ATOM 0x03 VPN 0x04 BGP 0x05 LDP

byte

MUL_DST_BYTES

Multicast destination bytes

IP multicast outgoing byte counter for bytes associated with the IP Flow

uint64

MUL_DST_PKTS

Multicast destination packets

IP multicast outgoing packet counter for packets associated with the IP Flow

uint64

MUL_IGMP_TYPE

Multicast IGMP type

Internet Group Management Protocol (IGMP) packet type

byte

OUT_BYTES

Outgoing bytes

Outgoing counter for the number of bytes associated with an IP Flow

uint64

OUT_DST_MAC

Outgoing destination MAC

Outgoing destination MAC address

mac

OUT_PKTS

Outgoing packets

Outgoing counter for the number of packets associated with an IP Flow.

uint64

OUT_SRC_MAC

Outgoing source MAC

Outgoing source MAC address

mac

OUTPUT_SNMP

Output interface

Output interface index

uint32

PROTOCOL

Protocol

IP protocol

byte

SAMPLER_NAME

Sampler name

Name of the flow sampler

string

SAMPLING_ALGORITHM

Sampling algorithm

The type of algorithm used for sampled NetFlow: 0x01 Deterministic Sampling ,0x02 Random Sampling

byte

SAMPLING_INTERVAL

Sampling interval

When using sampled NetFlow, the rate at which packets are sampled e.g. a value of 100 indicates that one of every 100 packets is sampled

uint32

SRC_AS

Source AS

Source BGP autonomous system number

uint32

SRC_MASK

Source mask

The number of contiguous bits in the source address subnet mask i.e. the submask in slash notation

byte

SRC_TOS

Source TOS

Type of Service byte setting when entering incoming interface

byte

SRC_VLAN

Source VLAN

Virtual LAN identifier associated with ingress interface

uint16

TCP_FLAGS

TCP flags

Cumulative of all the TCP flags seen for this flow

byte

TOTAL_BYTES_EXP

Total bytes exported

Counter for bytes for the number of bytes exported by the Observation Domain

uint64

TOTAL_FLOWS_EXP

Total flows exported

Counter for bytes for the number of flows exported by the Observation Domain

uint64

TOTAL_PKTS_EXP

Total packets exported

Counter for bytes for the number of packets exported by the Observation Domain

uint64

BgpNextAdjacentAsNumber

bgpNextAdjacentAsNumber

The autonomous system (AS) number of the first AS in the AS path to the destination IP address.

uint32

BgpPrevAdjacentAsNumber

bgpPrevAdjacentAsNumber

The autonomous system (AS) number of the last AS in the AS path from the source IP address.

uint32

ExporterIPv4Address

exporterIPv4Address

The IPv4 address used by the Exporting Process.

uint32

ExporterIPv6Address

exporterIPv6Address

The IPv6 address used by the Exporting Process.

ipv6

DroppedOctetDeltaCount

droppedOctetDeltaCount

The number of octets since the previous report (if any) in packets of this Flow dropped by packet treatment.

uint64

DroppedPacketDeltaCount

droppedPacketDeltaCount

The number of packets since the previous report (if any) of this Flow dropped by packet treatment.

uint64

DroppedOctetTotalCount

droppedOctetTotalCount

The total number of octets in packets of this Flow dropped by packet treatment since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload.

uint64

DroppedPacketTotalCount

droppedPacketTotalCount

The number of packets of this Flow dropped by packet treatment since the Metering Process (re-)initialization for this Observation Point.

uint64

FlowEndReason

flowEndReason

The reason for Flow termination.

byte

CommonPropertiesId

commonPropertiesId

An identifier of a set of common properties that is unique per Observation Domain and Transport Session.

uint64

ObservationPointId

observationPointId

An identifier of an Observation Point that is unique per Observation Domain.

uint32

IcmpTypeCodeIPv6

icmpTypeCodeIPv6

Type and Code of the IPv6 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code.

uint16

MplsTopLabelIPv6Address

mplsTopLabelIPv6Address

The IPv6 address of the system that the MPLS top label will cause this Flow to be forwarded to.

ipv6

LineCardId

lineCardId

An identifier of a line card that is unique per IPFIX Device hosting an Observation Point.

uint32

PortId

portId

An identifier of a line port that is unique per IPFIX Device hosting an Observation Point.

uint32

MeteringProcessId

meteringProcessId

An identifier of a Metering Process that is unique per IPFIX Device.

uint32

ExportingProcessId

exportingProcessId

An identifier of an Exporting Process that is unique per IPFIX Device.

uint32

TemplateId

templateId

An identifier of a Template that is locally unique within a combination of a Transport session and an Observation Domain. Template IDs of Data Sets are numbered from 256 to 65535.

uint16

WlanChannelId

wlanChannelId

The identifier of the 802.11 (Wi-Fi) channel used.

byte

WlanSSID

wlanSSID

The Service Set IDentifier (SSID) identifying an 802.11 (Wi-Fi) network used. According to IEEE.802-11.1999, the SSID is encoded into a string of up to 32 characters.

string

FlowId

flowId

An identifier of a Flow that is unique within an Observation Domain.

uint64

ObservationDomainId

observationDomainId

An identifier of an Observation Domain that is locally unique to an Exporting Process.

uint32

FlowStartSeconds

flowStartSeconds

The absolute timestamp of the first packet of this Flow (seconds).

uint32

FlowEndSeconds

flowEndSeconds

The absolute timestamp of the last packet of this Flow (seconds).

uint32

FlowStartMilliseconds

flowStartMilliseconds

The absolute timestamp of the first packet of this Flow (milliseconds).

uint64

FlowEndMilliseconds

flowEndMilliseconds

The absolute timestamp of the last packet of this Flow (milliseconds).

uint64

FlowStartMicroseconds

flowStartMicroseconds

The absolute timestamp of the first packet of this Flow (microseconds).

uint64

FlowEndMicroseconds

flowEndMicroseconds

The absolute timestamp of the last packet of this Flow (microseconds).

uint64

FlowStartNanoseconds

flowStartNanoseconds

The absolute timestamp of the first packet of this Flow (nanoseconds).

uint64

FlowEndNanoseconds

flowEndNanoseconds

The absolute timestamp of the last packet of this Flow (nanoseconds).

uint64

FlowStartDeltaMicroseconds

flowStartDeltaMicroseconds

The negative time offset of the first observed packet of this Flow relative to the export time specified in the IPFIX Message Header.

uint64

FlowEndDeltaMicroseconds

flowEndDeltaMicroseconds

uint64

SystemInitTimeMilliseconds

systemInitTimeMilliseconds

uint64

FlowDurationMilliseconds

flowDurationMilliseconds

uint64

FlowDurationMicroseconds

flowDurationMicroseconds

uint64

ObservedFlowTotalCount

observedFlowTotalCount

uint64

IgnoredPacketTotalCount

ignoredPacketTotalCount

uint64

IgnoredOctetTotalCount

ignoredOctetTotalCount

uint64

NotSentFlowTotalCount

notSentFlowTotalCount

uint64

NotSentPacketTotalCount

notSentPacketTotalCount

The total number of packets dropped by Metering Process

uint64

NotSentOctetTotalCount

notSentOctetTotalCount

The total number of octets in packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process.

uint64

DestinationIPv6Prefix

destinationIPv6Prefix

IPv6 destination address prefix.

ipv6

SourceIPv6Prefix

sourceIPv6Prefix

IPv6 source address prefix.

ipv6

PostOctetTotalCount

postOctetTotalCount

The definition of this Information Element is identical to the definition of Information Element 'octetTotalCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

uint64

PostPacketTotalCount

postPacketTotalCount

This is the same as 'packetTotalCount', but after the packet passed the Observation Point.

uint64

FlowKeyIndicator

flowKeyIndicator

This set of bit fields is used for marking the Information Elements of a Data Record that serve as Flow Key.

uint64

PostMCastPacketTotalCount

postMCastPacketTotalCount

The total number of outgoing multicast packets sent for packets of this Flow

uint64

PostMCastOctetTotalCount

postMCastOctetTotalCount

The total number of outgoing multicast octets sent for packets of this Flow

uint64

IcmpTypeIPv4

icmpTypeIPv4

Type of the IPv4 ICMP message.

uint16

IcmpCodeIPv4

icmpCodeIPv4

Code of the IPv4 ICMP message.

uint16

IcmpTypeIPv6

icmpTypeIPv6

Type of the IPv6 ICMP message.

uint16

IcmpCodeIPv6

icmpCodeIPv6

Code of the IPv6 ICMP message.

uint16

UdpSourcePort

udpSourcePort

The source port identifier in the UDP header.

uint16

UdpDestinationPort

udpDestinationPort

The destination port identifier in the UDP header.

uint16

TcpSourcePort

tcpSourcePort

The source port identifier in the TCP header.

uint16

TcpDestinationPort

tcpDestinationPort

The destination port identifier in the TCP header.

uint16

TcpSequenceNumber

tcpSequenceNumber

The sequence number in the TCP header.

uint32

TcpAcknowledgementNumber

tcpAcknowledgementNumber

The acknowledgement number in the TCP header.

uint32

TcpWindowSize

tcpWindowSize

The window field in the TCP header.

uint16

TcpUrgentPointer

tcpUrgentPointer

The urgent pointer in the TCP header.

uint16

TcpHeaderLength

tcpHeaderLength

The length of the TCP header.

byte

IpHeaderLength

ipHeaderLength

The length of the IP header. For IPv6, the value of this Information Element is 40.

byte

TotalLengthIPv4

totalLengthIPv4

The total length of the IPv4 packet.

uint16

PayloadLengthIPv6

payloadLengthIPv6

This Information Element reports the value of the Payload Length field in the IPv6 header.

uint16

IpTTL

ipTTL

For IPv4, the value of the Information Element matches the value of the Time to Live (TTL) field in the IPv4 packet header. For IPv6, the value of the Information Element matches the value of the Hop Limit field in the IPv6 packet header.

byte

NextHeaderIPv6

nextHeaderIPv6

The value of the Next Header field of the IPv6 header.

byte

MplsPayloadLength

mplsPayloadLength

The size of the MPLS packet without the label stack.

uint32

IpDiffServCodePoint

ipDiffServCodePoint

The value of a Differentiated Services Code Point (DSCP) encoded in the Differentiated Services field.

byte

IpPrecedence

ipPrecedence

The value of the IP Precedence. The IP Precedence value is encoded in the first 3 bits of the IPv4 TOS field or the IPv6 Traffic Class field, respectively.

byte

FragmentFlags

fragmentFlags

Fragmentation properties indicated by flags in the IPv4 packet header or the IPv6 Fragment header, respectively.

byte

OctetDeltaSumOfSquares

octetDeltaSumOfSquares

The sum of the squared numbers of octets per incoming packet since the previous report (if any) for this Flow at the Observation Point.

uint64

OctetTotalSumOfSquares

octetTotalSumOfSquares

The total sum of the squared numbers of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload.

uint64

MplsTopLabelTTL

mplsTopLabelTTL

The TTL field from the top MPLS label stack entry, i.e., the last label that was pushed.

byte

MplsLabelStackLength

mplsLabelStackLength

The length of the MPLS label stack in units of octets.

uint32

MplsLabelStackDepth

mplsLabelStackDepth

The number of labels in the MPLS label stack.

uint32

MplsTopLabelExp

mplsTopLabelExp

The Exp field from the top MPLS label stack entry, i.e., the last label that was pushed.

byte

IpPayloadLength

ipPayloadLength

The effective length of the IP payload.

uint32

UdpMessageLength

udpMessageLength

The value of the Length field in the UDP header.

uint16

IsMulticast

isMulticast

If the IP destination address is not a reserved multicast address, then the value of all bits of the octet (including the reserved ones) is zero.

byte

Ipv4IHL

ipv4IHL

The value of the Internet Header Length (IHL) field in the IPv4 header.

byte

Ipv4Options

ipv4Options

IPv4 options in packets of this Flow.

uint32

TcpOptions

tcpOptions

TCP options in packets of this Flow.

uint64

PaddingOctets

paddingOctets

The value of this Information Element is always a sequence of 0x00 values.

uint32

CollectorIPv4Address

collectorIPv4Address

An IPv4 address to which the Exporting Process sends Flow information.

uint32

CollectorIPv6Address

collectorIPv6Address

An IPv6 address to which the Exporting Process sends Flow information.

ipv6

ExportInterface

exportInterface

The index of the interface from which IPFIX Messages sent by the Exporting Process to a Collector leave the IPFIX Device.

uint32

ExportProtocolVersion

exportProtocolVersion

The protocol version used by the Exporting Process for sending Flow information.

byte

ExportTransportProtocol

exportTransportProtocol

The value of the protocol number used by the Exporting Process for sending Flow information.

byte

CollectorTransportPort

collectorTransportPort

The destination port identifier to which the Exporting Process sends Flow information.

uint16

ExporterTransportPort

exporterTransportPort

The source port identifier from which the Exporting Process sends Flow information.

uint16

TcpSynTotalCount

tcpSynTotalCount

The total number of packets of this Flow with TCP "Synchronize sequence numbers" (SYN) flag set.

uint64

TcpFinTotalCount

tcpFinTotalCount

The total number of packets of this Flow with TCP "No more data from sender" (FIN) flag set

uint64

TcpRstTotalCount

tcpRstTotalCount

The total number of packets of this Flow with TCP "Reset the connection" (RST) flag set.

uint64

TcpPshTotalCount

tcpPshTotalCount

The total number of packets of this Flow with TCP "Push Function" (PSH) flag set.

uint64

TcpAckTotalCount

tcpAckTotalCount

The total number of packets of this Flow with TCP "Acknowledgment field significant" (ACK) flag set.

uint64

TcpUrgTotalCount

tcpUrgTotalCount

The total number of packets of this Flow with TCP "Urgent Pointer field significant" (URG) flag set.

uint64

IpTotalLength

ipTotalLength

The total length of the IP packet.

uint64

PostMplsTopLabelExp

postMplsTopLabelExp

The definition of this Information Element is identical to the definition of Information Element 'mplsTopLabelExp', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

byte

TcpWindowScale

tcpWindowScale

The scale of the window field in the TCP header.

uint16