draft-bclaise-netflow-9




   Internet Draft                                                       
   Expiration: December 2002                                  B. Claise 
   Document: draft-bclaise-netflow-9-00.txt               Cisco Systems 
   Category: Informational                                    June 2002 
    
    
              Cisco Systems NetFlow Services Export Version 9 
                                      
    
Status of this Memo 
    
   This document is an Internet-Draft and is in full conformance with  
   all provisions of Section 10 of RFC2026.  
    
   Internet-Drafts are working documents of the Internet Engineering  
   Task Force (IETF), its areas, and its working groups.  Note that  
   other groups may also distribute working documents as Internet-  
   Drafts. Internet-Drafts are draft documents valid for a maximum of  
   six months and may be updated, replaced, or obsoleted by other  
   documents at any time. It is inappropriate to use Internet- Drafts as  
   reference material or to cite them other than as "work in progress."  
    
   The list of current Internet-Drafts can be accessed at  
   http://www.ietf.org/ietf/1id-abstracts.txt  
   The list of Internet-Draft Shadow Directories can be accessed at   
   http://www.ietf.org/shadow.html. 
     
    
Abstract 
    
   Cisco Systems NetFlow Services provide network administrators with 
   access to information concerning IP Flows within their data networks. 
   Exported NetFlow Services data can be used for a variety of purposes,  
   including network management and planning, accounting, and 
   departmental chargebacks, Internet Service Provider billing, data 
   warehousing, and data mining for marketing purposes. 
    
   This paper discusses the most recent evolution of the NetFlow flow 
   export format, which is known as Version 9. The distinguishing 
   feature of the NetFlow Version 9 format compared to previous formats, 
   is that it is template based. Templates (collection of fields along 
   with the description and structure) provide a flexible and extensible 
   design to the record format. These two features that allow future 
   enhancements to NetFlow services without requiring concurrent changes 
   to the basic flow-record format and minimize the consumed export 
   bandwidth  
    
    
 
 
Claise                 Expires - December 2002               [Page 1] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
Conventions used in this document 
    
   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in  
   this document are to be interpreted as described in RFC 2119. 
 
    
Table of Contents 
    
   1. Introduction...................................................2 
      1.1 Overview...................................................2 
      1.2 Applications...............................................3 
   2. Terminology used...............................................5 
   3. NetFlow High Level Picture on the Exporter.....................8 
      3.1 The NetFlow Process on the Exporter........................8 
      3.2 Flow Expiration............................................8 
      3.3 Transport Protocol.........................................9 
   4. Packet Layout..................................................9 
   5. Export Packet Format..........................................10 
      5.1 Header Format.............................................10 
      5.2 Template FlowSet Format...................................12 
      5.3 Data FlowSet Format.......................................13 
   6. Options.......................................................15 
      6.1 Options Template FlowSet..................................15 
      6.2 Options Data FlowSet......................................17 
   7. Templates Management..........................................19 
   8. Field Type Definitions........................................20 
   9. The Collector's side..........................................23 
   10. Examples.....................................................23 
      10.1 Packet Header Example....................................24 
      10.2 Template FlowSet Example.................................24 
      10.3 Data FlowSet Example.....................................25 
      10.4 Option Template FlowSet Example..........................26 
      10.5 Option Data FlowSet Example..............................27 
   11. References...................................................28 
   12. Contributors.................................................28 
   13. Acknowledgments..............................................28 
   14. Authors Addresses............................................28 
    
    
1. Introduction 
    
1.1 Overview 
    
   The NetFlow services data can be used for a variety of purposes. A 
   non-exhaustive list can be found in the next section. This paper  
   discusses the most recent evolution of the NetFlow flow-record  
   format, which is known as Version 9. The distinguishing feature of  
 
 
Claise                      Informational                    [Page 2] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
   the NetFlow Version 9 format compared to previous formats, is that  
   it is template based. Template is a collection of fields along with  
   the description of their structure and semantics.  
 
 
   This approach gives the following advantages: 
 
   - The template mechanism is flexible in the sense that only the  
     required fields from the IP Flows are exported to the NetFlow     
     Collector. This helps achieve bandwidth savings on exported flow  
     data and possible memory savings at exporter and collector.  
     Sending the required information only can reduce the network load  
     also.  
 
   - Using the template mechanism, new fields can be added to NetFlow  
     export records without changing the structure of export record 
     format. With the previous NetFlow versions, without this template-
     based mechanism, supporting a new field in the Flow Record implied 
     a new version of the export protocol format and a new version of 
     the NetFlow Collector supporting the parsing of this new export 
     protocol format. 
 
   - Templates which are sent to the Collector contains the  
     structural information about the exported Flow Records fields. So,  
     even if the Collector does not understand the semantics of  
     new fields, it can still interpret the Flow Record. 
    
    
1.2 Applications 
    
   NetFlow Data enables several key customer applications:  
 
   Accounting and billing 
   NetFlow Services data provides fine-grained metering (for example,  
   Flow data includes details such as IP addresses, packet and byte  
   counts, timestamps, Type of Service (TOS), application ports and  
   so on) for highly flexible and detailed resource usage accounting.  
   Internet Service Providers (ISP) may use this information to migrate  
   away from single fee, flat-rate billing to more flexible charging  
   mechanisms based on time-of-day, bandwidth usage, application usage,  
   quality of service, and so on. Enterprise customers may use the  
   information for departmental chargeback or cost allocation for  
   resource usage.  
 
 
Claise                      Informational                    [Page 3] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
 
   Network planning  
   NetFlow Services data captured in long-term observations allows to  
   track and anticipate network growth and plan upgrades with  
   additional routing devices, ports, or higher-bandwidth interfaces.  
   NetFlow data optimize both strategic network planning (such as who  
   to peer with, backbone upgrade planning, and routing policy  
   planning) as well as tactical network engineering decisions (such as  
   upgrading the router capacity or the link capacity) to minimize the  
   total cost of network operations while maximizing network  
   performance, capacity, and reliability. 
 
   Peering agreements 
   NetFlow Services data provides ISP peering partners the ability to  
   measure the volume and characteristics of traffic exchanged with  
   other ISP peers. 
 
   Traffic engineering 
   NetFlow Services data provides autonomous system (AS) traffic  
   engineering details for an AS. You can use NetFlow-captured traffic  
   data to understand traffic trends by source destination. This data  
   can be used to help in network optimization for load balancing  
   traffic across alternate paths or by forwarding traffic to a  
   preferred route. 
 
   Network monitoring 
   NetFlow Services data enables extensive near real-time network  
   monitoring capabilities. You can use NetFlow Flow data analysis to  
   display traffic patterns associated with individual routing devices  
   and switches as well as on a network-wide basis (providing aggregate  
   traffic or application-based views) to provide proactive problem  
   detection, efficient troubleshooting, and rapid problem resolution.  
 
   Application monitoring and profiling 
   NetFlow Services data enables content and service providers the  
   ability to view detailed, time-based application usage over a  
   network. This information allows to plan and allocate network and  
   application resources (such as Web server sizing and location) to  
   responsively meet customer demands. Measure NetFlow traffic data for  
   characterizing IP resources for IP address  distribution per region  
   (continent or country) or traffic breakdown per protocol or  
   application Voice over IP (VoIP), web hosting, gaming, and  
   multimedia). 
 
 
Claise                      Informational                    [Page 4] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
   User monitoring and profiling 
   NetFlow Services data enables to gain detailed understanding of  
   customer/user usage of network and application resources. This  
   information may then be used to efficiently plan and allocate  
   access, backbone, and application resources as well as to detect and  
   resolve potential security and policy violations. 
 
   Volume usage-based billing 
   NetFlow Services traffic data can be measured to build a flexible  
   usage-based billing to your users. For example, you can identify  
   users by the destination prefix. 
 
   Security analysis 
   NetFlow Services data provides details on source and destination  
   addresses, the start time of Flows, and application ports. NetFlow  
   data measured from a routing device can be used to analyze your  
   network security and identify attacks. 
 
   NetFlow data warehousing and mining 
   NetFlow data (or derived information) can be warehoused for later  
   retrieval and analysis to support proactive  marketing and customer  
   service programs (for example, to determine which  applications and  
   services are being used by internal and external users and  target  
   them for improved service, advertising, and so on). This is  
   especially useful for ISPs because NetFlow Services data enables  
   them to create great depth in their service packaging.  
    
    
2. Terminology used 
    
   Various terms used in this document are described below: 
 
   IP Flow or Flow 
   A Flow is defined as a set of IP packets passing an Observation  
   Point in the network during a certain time interval. All packets  
   belonging to a particular Flow have a set of common properties  
   derived from the data contained in the packet and from the packet  
   treatment at the Observation Point. 
 
   Flow Record  
   A Flow Record provides information about an IP Flow that exists on  
   the Exporter. The Flow Records are commonly referred to NetFlow  
   Services data or NetFlow data. 

 
 
Claise                      Informational                    [Page 5] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
 
   Exporter 
   A device (for example, a router) with NetFlow services enabled. The  
   exporter monitors packets entering an observation point and creates  
   flows out of these packets. The information from these flows are  
   exported in the form of Flow Records to the collector. 
 
   NetFlow Collector 
   The NetFlow Collector receives Flow Records from one or more  
   Exporters. It processes the received export packet, i.e. parses,  
   stores the Flow Record information. The flow records may be  
   optionally aggregated before storing into the hard disk. 
     
   Observation Point 
   The Observation Point is a location in the network where IP packets  
   can be observed. Typical examples: one or a set of interfaces of the  
   exporter. The Observation Point is part of an Observation Domain. 
 
   Observation Domain: 
   The set of Observation Points which is the largest aggregatable set  
   of Flow information at the Exporter is termed as an Observation  
   Domain. The Observation Domain presents itself a unique ID to the  
   Collector for identifying the Export Packets generated by it.  
   Example: The Observation Domain could be a router line-card,  
   composed of several interfaces with each interface being an  
   Observation Point. 
 
   Export Packet 
   A packet built by an Exporter whose destination is the NetFlow  
   Collector.  
 
    Export Packet: 
    +--------+------------------------------------------------------+ 
    | Packet | +-----------------+ +------------------+ +---------+ | 
    | Header | | FlowSet         | | FlowSet          | | FlowSet | | 
    |        | +-----------------+ +------------------+ +---------+ | 
    +--------+------------------------------------------------------+ 
 
   Packet Header  
   The first part of an Export Packet, which provides basic information  
   about the packet, such as the NetFlow version, number of records  
   contained within the packet, and sequence numbering. 
 
 
 
Claise                      Informational                    [Page 6] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
   FlowSet 
   Following the Packet Header, an Export Packet contains information  
   that MUST be parsed and interpreted by the Collector device. FlowSet  
   is a generic term for a collection of records which have similar  
   structure. Packet Header is followed by one or more FlowSets. 
   There are three different types of FlowSets: Template FlowSet, Data  
   FlowSet and Option FlowSet. An Export Packet contains one or more  
   FlowSets, and the three FlowSet types can be mixed within the same  
   Export Packet. 
 
   Template Record 
   A Template Record is used to define the structure and interpretation  
   of fields in a data record. Data records that corresponds to a  
   template MAY appear in the same and/or subsequent Export Packets.  
   The template information is not necessarily carried in every Export  
   Packet. As such the NetFlow Collector MUST store the "Template  
   Record" in order to interpret the corresponding data records that  
   are received in the subsequent data packets. 
 
   Template FlowSet 
   A Template FlowSet is a collection of one or more Template Records  
   which have been grouped together in an Export Packet. 
  
   Template ID 
   A unique number that distinguishes this Template Record from all  
   other Template Records produced by the same Exporter.  A Collector  
   that is receiving Export Packets from several devices MUST be aware  
   that uniqueness of Template ID is not guaranteed across Exporters.   
   Thus, the Collector MUST also store the address of the Exporter that  
   produced the Template ID, in order to enforce uniqueness. 
 
   Data FlowSet 
   A Data FlowSet is a collection of one or more Flow Records that have  
   been grouped together in an Export Packet. A Data FlowSet contains  
   records that belong to the same Template ID. Each Data FlowSet will  
   reference a previously transmitted Template ID, which can be used to  
   parse the data contained within the Flow Records.  
 
   Options Template  
   A template that describes the format of the Flow measurement  
   parameters (like the sampling algorithm, sampling interval) done at  
   the Exporter. Option Templates are identified by a well-known  
   Template ID. 
 
 
Claise                      Informational                    [Page 7] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
 
   Options Data Record 
   The data record that contains values of the Flow measurement  
   parameters corresponding to an Option Template. 
 
   FlowSet ID 
   The FlowSet ID is used to distinguish the different FlowSet Types:  
   Template, Option and Data. FlowSet ID between 0 and 255 are  
   reserved.  
   The Template FlowSet has a FlowSet ID equals to 0. 
   The Option Template FlowSet has a FlowSet ID equals to 1. 
   The Data FlowSets have a FlowSet ID greater than 255. 
 
    
3. NetFlow High Level Picture on the Exporter 
    
3.1 The NetFlow Process on the Exporter 
    
   The description of the NetFlow Process (sampled NetFlow, full  
   NetFlow or aggregation), i.e. the way that Flows are deduced from  
   the observed IP packets is out of the scope of this document. 
    
3.2 Flow Expiration 
    
   A Flow is considered to be inactive if no packets of this Flow has 
   been observed at the Observation Point for a given timeout interval. 
   The Flow can be exported under the following conditions: 
 
    1. If the Exporter can deduce the end of a Flow, the Exporter 
       SHOULD export the Flow Records when the end of the Flow is 
       detected.  For example: Flow generated by TCP [3] type of   
       traffic where the FIN or RST bits indicate the end of the Flow 
 
    2. If the Flow has been inactive for a certain period of time. This 
       inactivity timeout SHOULD be configurable.  For example: Flow 
       generated by UDP [2] type of traffic. 
 
    3. For long lasting Flows, the Exporter SHOULD export the Flow  
       Records on regular basis, in order to report the Flow Records  
       periodic accounting information to the Collector on regular  
       basis. This activity timeout SHOULD be configurable 
 
    4. If the Exporter experiences internal constraints, a Flow MAY be 
       prematurely expired (example: counters wrapping or low memory) 
 
 
Claise                      Informational                    [Page 8] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
    
3.3 Transport Protocol 
    
   To achieve efficiency in terms of processing at the Exporter while  
   handling high volume of export, Flow Records are grouped together  
   into UDP [2] datagrams for export to the Collector. Nevertheless  
   NetFlow Version 9 has been designed to be transport protocol  
   independent. Hence, it can also operate over congestion aware  
   protocols like TCP [3] or SCTP [4].  
 
   Note that the Exporter has the possibility to export to multiple  
   Collectors.  
    
    
4. Packet Layout 
    
   An Export Package consist of a Packet Header followed by one or  
   More FlowSets. The FlowSets can be any of the possible types:   
   Template, Data or Option.  
 
   Export Packet: 
   +--------+------------------------------------------+ 
   |        | +----------+ +---------+ +---------+     | 
   | Packet | | Template | | Data    | | Option  |     | 
   | Header | | FlowSet  | | FlowSet | | FlowSet | ... | 
   |        | +----------+ +---------+ +---------+     | 
   +--------+------------------------------------------+ 
 
   The possible combinations that can occur in an Export Packet are: 
 
   - An Export Packet that consists of interleaved Template and Data  
   FlowSets.  
 
     Export Packet: 
     +--------+-------------------------------------------------------+ 
     |        | +----------+ +---------+     +----------+ +---------+ | 
     | Packet | | Template | | Data    | ... | Template | | Data    | | 
     | Header | | FlowSet  | | FlowSet | ... | FlowSet  | | FlowSet | | 
     |        | +----------+ +---------+     +----------+ +---------+ | 
     +--------+-------------------------------------------------------+ 
 
   - An Export Packet consisting entirely of Data FlowSets. Once the  
   appropriate Template IDs have been defined and transmitted to the  

 
 
Claise                      Informational                    [Page 9] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
   Collector device, the majority of Export Packets will consist solely  
   of Data FlowSets.  
 
 
     Export Packet: 
     +--------+----------------------------------------------+ 
     |        | +---------+     +---------+      +---------+ | 
     | Packet | | Data    | ... | Data    | ...  | Data    | | 
     | Header | | FlowSet | ... | FlowSet | ...  | FlowSet | | 
     |        | +---------+     +---------+      +---------+ | 
     +--------+----------------------------------------------+   
 
   - An Export Packet consisting entirely of Template FlowSets. The   
   Exporter MAY transmit a packet containing Template FlowSets only, 
   ahead of time to help ensure that the Collector has the correct 
   template information before receiving the first data FlowSet. 
 
     Export Packet: 
     +--------+-------------------------------------------------+ 
     |        | +----------+     +----------+      +----------+ | 
     | Packet | | Template | ... | Template | ...  | Template | | 
     | Header | | FlowSet  | ... | FlowSet  | ...  | FlowSet  | | 
     |        | +----------+     +----------+      +----------+ | 
     +--------+-------------------------------------------------+ 
  
   A Template FlowSet provides a description of the fields that will be  
   present in future Data FlowSets.  These Data FlowSets MAY occur  
   later within the same Export Packet or in subsequent Export Packets. 
  
   The format of both Template and Data FlowSets will be discussed  
   later in this document. 
    
    
5. Export Packet Format 
    
5.1 Header Format 
    
   Note that the Packet Header format has been kept similar to the one  
   Developed by the different versions of NetFlow defined by Cisco  
   Systems, for backward compatibility.  
   This is also the reason why the version field is 9 with this 
   version. 
 

 
 
Claise                      Informational                   [Page 10] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
     0                   1                   2                   3 
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |       Version Number          |            Count              | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                           sysUpTime                           | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                           Unix Secs                           | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                       Sequence Number                         | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                        Source ID                              | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 
  
    Packet Header Field Descriptions  
 
    Version 
              The version of Flow Record format exported in this   
              packet. 
              For this current version, this value will be 0x0009  
 
    Count 
              Count is total number of records in the Export Packet  
              where the record(s) are the record(s) in the Option  
              Flowset and the record(s) in the Template FlowSet or the  
              record(s) in the Data Flowset 
 
    SysUpTime 
              Time in milliseconds since this device was first booted. 
              Refer to [1]. 
 
    Unix Secs 
              Seconds since 0000 UTC 1970. 
  
    Sequence Number 
              Incremental sequence counter of all Export Packets sent  
              from the current Observation Domain by the Exporter. This  
              value will be cumulative, and can be used to identify  
              whether any Export Packets have been missed.  
 
 
 
 
 
Claise                      Informational                   [Page 11] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
    Source ID 
              The Source ID field is a 32-bit value that characterizes  
              the Observation Domain. Collectors SHOULD use the  
              combination of the source IP address and the Source ID  
              field to separate different export streams originating  
              from the same Exporter. 
    
    
5.2 Template FlowSet Format 
    
   One of the key elements in the NetFlow format is the Template  
   FlowSet. Templates greatly enhance the flexibility of the Flow  
   Record format, because they allow a Collector to process Flow  
   Records without necessarily knowing the interpretation of all the  
   data in the Flow Record.   
 
   The format of the Template FlowSet is described below: 
 
     0                   1                   2                   3 
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |       FlowSet ID = 0          |          Length               | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |       Template ID 1           |         Field Count           | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |        Field Type 1           |         Field Length 1        | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |        Field Type 2           |         Field Length 2        | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |             ...               |              ...              | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |        Field Type N           |         Field Length N        | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |       Template ID 2           |         Field Count           | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |        Field Type 1           |         Field Length 1        | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |        Field Type 2           |         Field Length 2        | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |             ...               |              ...              | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |        Field Type M           |         Field Length M        | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 

 
 
Claise                      Informational                   [Page 12] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
  
    Template FlowSet Field Descriptions  
 
    FlowSet ID 
           The FlowSet ID is 0 in the case of Template FlowSet 
             
    Length 
           Total length of this FlowSet. Since an individual Template 
           FlowSet MAY contain multiple Template Records, the Length  
           value MUST be used to determine the position of the next  
                          FlowSet Record, which could be any type of FlowSet.          
           Length is expressed like the "length" field in Type Length  
           Value (TLV) format which is the sum total of lengths of  
           FlowSet ID, Length itself and all Template Records within  
           this FlowSet Template ID. 
 
    Template ID 
           As a router generates different Template FlowSets to match 
           the type of data it will be exporting, each individual 
           Template is given a unique ID. This uniqueness is local to  
           the Observation Domain that generated the Template ID.  
           Template IDs 0-255 are reserved for FlowSet IDs. Templates  
           that define Data Record formats begin numbering at 256. 
 
    Field Count 
           Number of fields in this Template Record. Since a Template  
           FlowSet usually contain multiple Template Records, this  
           field allows the Collector to determine the end of the  
           current Template Record and the start of the next. 
  
    Field Type 
           A numeric value that represents the type of the field. Refer  
           to the Field Type Definitions section.        
  
    Field Length 
           The length of the above-defined field, in bytes. Refer to  
           The Field Type Definitions section.       
 
    
5.3 Data FlowSet Format 
    
    The format of the Data FlowSet is described below: 
 

 
 
Claise                      Informational                   [Page 13] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
 
      0                   1                   2                   3 
      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |    FlowSet ID = Template ID   |          Length               | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |   Record 1 - Field Value 1    |   Record 1 - Field Value 2    | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |   Record 1 - Field Value 3    |             ...               | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |   Record 2 - Field Value 1    |   Record 2 - Field Value 2    | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |   Record 2 - Field Value 3    |             ...               | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |   Record 3 - Field Value 1    |             ...               | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |              ...              |            Padding            | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   
 
  Data FlowSet Field Descriptions  
 
    FlowSet ID = Template ID 
           Each group of records within a Data FlowSet will be preceded  
           by a FlowSet ID. The FlowSet ID maps to a (previously  
           generated) Template ID. The Collector MUST use the FlowSet  
           ID to map the appropriate type and length to any field  
           values that follow. 
 
    Length 
           The length of the Data FlowSet.  
           Length is expressed like the "length" field in TLV format  
           which is the sum total of lengths of FlowSet ID, Length  
           itself, all Template Records within this FlowSet Template ID  
           and the padding bytes (if present).       
  
    Record N - Field Value N 
           The remainder of the Data FlowSet is a collection of Flow  
           Records each containing a set of field types and values. The  
           Type and Length of the fields have been previously defined  
           in the Template Record referenced by the FlowSet ID/Template    
                           ID. 
 
 
 
 
Claise                      Informational                   [Page 14] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
    Padding 
           Padding SHOULD be inserted to align the end of the FlowSet 
           on a 32 bit boundary. Pay attention that the Length field 
           will include those padding bits. 
 
   The important part in interpreting the Data FlowSet format is  
   to understand that the fields cannot be parsed without a  
   corresponding Template ID. 
    
    
6. Options 
 
    
6.1 Options Template FlowSet 
    
   The Options Template (and its corresponding Options Data Record) are  
   used to supply information about the NetFlow Process configuration  
   or NetFlow Process specific data, rather than supplying information  
   about IP Flows.  
   For example, the sample rate of a specific interface, if sampling is  
   supported, along with the sampling method used. 
 
   The format of the Options Template FlowSet is detailed below: 
 
           0                   1                   2                   3 
      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |       FlowSet ID = 1          |          Length               | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |         Template ID           |      Option Scope Length      | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |        Option Length          |       Scope 1 Field Type      | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |     Scope 1 Field Length      |               ...             | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |     Scope N Field Length      |      Option 1 Field Type      | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |     Option 1 Field Length     |             ...               | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |     Option N Field Length     |           Padding             | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 
 
 
 
 
Claise                      Informational                   [Page 15] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
    Options Template Field Definitions   
 
    FlowSet ID = 1 
           FlowSet ID of 1 is reserved for Option Template 
  
    Length 
           Total length of this FlowSet. Since an individual Option  
           Template MAY contain multiple Template IDs, the Length value  
           MUST be used to determine the position of the next FlowSet  
           record, which could be either a Template FlowSet or Data  
           FlowSet.                
           Length is expressed like the "length" field in TLV format  
           which is the sum total of lengths of FlowSet ID, Length  
           itself and all Template Records within this FlowSet Template  
           ID.    
                     
    Template ID 
           Template ID is greater than 255.  
           The Template ID inferior to 255 are reserved. 
  
    Option Scope Length 
           The length in bytes of any Scope fields contained in this  
           Options Template (The use of "Scope" is described below). 
  
    Options Length 
           The length (in bytes) of any options field definitions  
           contained in this Options Template. 
  
    Scope 1 Field Type 
           The relevant portion of the Exporter/NetFlow Process to  
           which the Options Record refers. Currently defined values  
           are: 
                      0x0001 System   
                      0x0002 Interface  
                      0x0003 Line Card  
                      0x0004 Cache  
                      0x0005 Template      
           For example, the NetFlow Process can be implemented on a 
           per-interface basis, so if the Options record were reporting  
           on how the NetFlow Process is configured, the SCOPE for the  
           report would be 0x0002 (Interface). The associated Interface  
           ID would then be carried in the associated Option Data  
           FlowSet. 
 
 
Claise                      Informational                   [Page 16] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
  
    Scope 1 Field Length 
           The length (in bytes) of the scope field, as it would appear  
           in an Options Record. 
  
    Option 1 Field Type 
           A numeric value that represents the type of the field that  
           will appear in the Options record. Refer to the Field Type   
           Definitions section. 
 
    Option 1 Field Length 
           The length (in bytes) of the field, as it would appear in an  
           Options Record. 
 
    Padding 
           Padding SHOULD be inserted to align the end of the FlowSet 
           on a 32 bit boundary. Pay attention that the Length field 
           will include those padding bits. 
 
    
6.2 Options Data FlowSet 
    
   The Option Data records are sent in Data FlowSets, on a regular   
   Basis, but not with every single Flow Record. How frequently these  
   Option Data Records are exported is configurable. See the Templates  
   Management section for more details.  
 
   The Options Data format is described below: 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Claise                      Informational                   [Page 17] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
      0                   1                   2                   3 
      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |    FlowSet ID = Template ID   |          Length               | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |   Record 1 - Scope 1 Value    |Record 1 - Option Field 1 Value| 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |Record 1 - Option Field 2 Value|             ...               | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |   Record 2 - Scope 1 Value    |Record 2 - Option Field 1 Value| 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |Record 2 - Option Field 2 Value|             ...               | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |   Record 3 - Scope 1 Value    |Record 3 - Option Field 1 Value| 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |Record 3 - Option Field 2 Value|             ...               | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |              ...              |            Padding            | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 
  Options Data FlowSet Field Descriptions  
 
    FlowSet ID = Template ID 
           Each group of records within an Option Data FlowSet will be  
           preceded by a FlowSet ID. The FlowSet ID maps to a  
           (previously generated) Template ID. The Collector MUST use  
           the FlowSet ID to map the appropriate type and length to any  
           field values that follow. 
 
    Length 
           The length of the Option Data FlowSet.  
           Length is expressed like the "length" field in TLV format  
           which is the sum total of lengths of FlowSet ID, Length  
           itself, all Template Records within this FlowSet Template ID  
           and the padding bytes (if present).       
  
    Record N - Option Field N Value 
           The remainder of the Option Data FlowSet is a collection of  
           Flow Records each containing a set of field types and  
           values. The Type and Length of the fields have been  
           previously defined in the Option Template Record referenced  
           by the FlowSet ID/Template ID. 
 
 
 
Claise                      Informational                   [Page 18] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
    Padding 
           Padding SHOULD be inserted to align the end of the FlowSet 
           on a 32 bit boundary. Pay attention that the Length field 
           will include those padding bits. 
 
   The important part in interpreting the Options Data FlowSet format  
   is to understand that the fields cannot be parsed without a  
   corresponding Template ID. 
    
    
7. Templates Management 
    
   The Template IDs must remain constant at least from one re- 
   Initialization of the NetFlow Process to the next ôre- 
   initializationö.  
   If the Exporter or the NetFlow Process reinitializes itself, all  
   information about Templates will be lost. New Template IDs MUST be  
   recreated. Template IDs are thus not guaranteed to be consistent  
   across an exporter or NetFlow Process restart. 
 
   If a Template FlowSet (or Option Template FlowSet) is contained in  
   an export packet, it will apply to all Data FlowSets (or to all  
   Option Data FlowSet) in the export packet (and all subsequent  
   packets), regardless of the FlowSets order in the export packet. 
 
   When a new template is configured on the exporter, it will always  
   generate a new Template ID. According to the same principles, if the  
   template configuration is changed, then the current Template ID is  
   abandoned and not reused anymore until the next exporter  
   reinitilization. A new Template ID MUST be assigned to this new  
   Template, in order to avoid any confusion on the Collector. 
 
   If a configured template configured on the exporter is deleted,  
   and re-configured with exactly the same parameters, the same  
   Template ID COULD be reused. 
 
   The Exporter sends the Template FlowSet and Option Template FlowSet 
   under the following conditions: 
 
    1. On an Exporter or NetFlow Process restart, the Exporter MUST NOT 
       send any Data Flowset without having the corresponding Template 
       Flowset and the required Option Template Flowset sent out in a 
       previous packet or in the same packet. It MAY transmit this 

 
 
Claise                      Informational                   [Page 19] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
       Template FlowSet and Option Template FlowSet, without any Data 
       FlowSets, ahead of time to help ensuring that the Collector will 
       have the correct template information before receiving the first 
       data. 
 
    2. On the NetFlow Process configuration changes, i.e. whenever a  
       new Template is created, the exporter SHOULD send the 
       incremental changes at an accelerated rate. Again, it MAY 
       transmit this Template FlowSet and Option Template FlowSet, 
       without any data, ahead of time to help ensure that the 
       Collector will have the correct template information before 
       receiving the first data. 
 
    3. On a regular basis, the Exporter MUST send all the Template  
       FlowSets to refresh the exporter. Keep in mind that the Template  
       IDs have a limited lifetime and MUST be periodically refreshed.  
       Two ways are possible: 
        * every N number of export packets. 
        * on regular basis, so every N number of minutes. 
       Both options MUST be user configurable. 
       When one of these expiry condition is met, the Exporter MUST  
       send the Template FlowSet and Option Template FlowSet without  
       waiting for the next Data FlowSet, i.e. without waiting for the  
       next expired Flow. 
    
    
8. Field Type Definitions 
    
   The table below describes all the field type definitions that an  
   exporter MAY support. The fields are a selection of Packet Header  
   fields, lookup results (for example the AS numbers or the subnet  
   masks), properties of the packet itself like length. 
 
    Field Type             Value   Length  Description 
                                   (bytes) 
 
                                           counter with length  
    IN_BYTES                 1       N     N x 8 bits for bytes 
                                           associated with an IP Flow 
 
                                           counter with length 
    IN_PKTS                  2       N     N x 8 bits for packets 
                                           associated with an IP Flow 

 
 
Claise                      Informational                   [Page 20] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
 
    FLOWS                    3       4     Number of Flows 
                                           that were aggregated 
 
    PROT                     4       1     IP protocol byte 
 
    TOS                      5       1     Type of service byte 
 
    TCP_FLAGS                6       1     TCP Flags (cumulative OR 
                                           of TCP flags) 
 
                                           TCP/UDP source port number 
    L4_SRC_PORT              7       2     (e.g., FTP, Telnet, 
                                           etc... ,or equivalent) 
 
    IP_SRC_ADDR              8       N     Source IP Address 
                                           IPv4 have N=4 
                                           IPv6 have N=16 
 
    SRC_MASK                 9       1     source route mask bits 
 
    INPUT_SNMP               10      2     Input interface index 
 
                                           TCP/UDP destination port 
    L4_DST_PORT              11      2     number (e.g., FTP, Telnet, 
                                           etc... ,or equivalent) 
 
    IP_DST_ADDR              12      N     Destination IP Address 
                                           IPv4 have N=4 
                                           IPv6 have N=16 
 
    DST_MASK                 13      1     destination route mask bits 
 
    OUTPUT_SNMP              14      2     Output interface index 
 
    IP_NEXT_HOP              15      N     Next hop router's IP 
                                           address 
                                           IPv4 have N=4 
                                           IPv6 have N=16 
 
    SRC_AS                   16      4     Source BGP Autonomous 
                                           System number 
 
 
 
Claise                      Informational                   [Page 21] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
    DST_AS                   17      4     Destination BGP Autonomous 
                                           System number 
 
    BGP_NEXT_HOP             18      N     Next-hop router's IP 
                                           in the BGP domain 
                                           IPv4 have N=4 
                                           IPv6 have N=16 
 
    MUL_DPKTS                19      4     Packet count for IP 
                                           multicast 
 
    MUL_DOCTETS              20      4     Octet (byte) count for IP 
                                           multicast 
 
                                           SysUptime at which the 
    LAST_SWITCHED            21      4     last packet of this Flow 
                                           was switched 
 
                                           SysUptime at which the 
    FIRST_SWITCHED           22      4     first packet of this Flow 
                                           was switched 
 
    PKTS                     24      8     64-bit counter for packets 
                                           associated with an IP Flow 
 
    TOTAL_BYTES_EXP          40      4     Number of Bytes exported by  
                                           the Observation Domain 
 
    TOTAL_EXP_PKTS_SENT      41      4     Number of Packets exported          
                                           by the Observation Domain 
 
    TOTAL_FLOWS_EXP          42      4     Number of Flows exported by  
                                           the Observation Domain 
 
   The value field is an numeric identifier for the field type. 
 
   When extensibility will be needed (when new technologies will   
   require some new field types), the new field types will be added to  
   the list. The new field types file will simply have to updated on  
   the Collector. Anyway, the NetFlow export format will remain  
   unchanged. Refer to the latest documentation at http://www.cisco.com  
   for the newly updated list. 
 
 
 
Claise                      Informational                   [Page 22] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
    
9. The Collector's side 
    
   The Collector will receive template definitions from the Exporter,  
   normally before receiving Flow Records. The Flow Records can then be  
   decoded and stored locally on the devices. In case the template  
   definitions have not been received at the time a Flow Record is  
   received, the Collector SHOULD keep the Flow Record for later decode  
   once the template definitions will be received. A Collector device  
   MUST NOT assume that the Data FlowSet and the associated Template  
   IDs are exported in the same Export Packet. 
 
   The Collector MUST NOT assume that one and only one Template FlowSet  
   is present in an Export Packet; in rare circumstances, the Export  
   Packet MAY contain several Template FlowSets.  
 
   Templates live only for a certain timeframe. The lifetime of a  
   Template SHOULD be deducted on the Collector based upon the time  
   where the last Template FlowSet was received from the Exporter. The  
   collector MUST NOT attempt to decode the Flow Records with an  
   expired Template. 
   Hence, the Collector SHOULD maintain a similar list:  
   <Exporter, Observation Domain, Template ID, Template Def, Last  
   Received> 
 
   If a new Template definition is received (for example in case of an  
   Exporter restart) it SHOULD immediately override the existing  
   definition. 
 
   Keep in mind that the Template IDs are unique per Exporter and per  
   Observation Domain. 
    
    
10. Examples 
    
    Let's take the example of an Export Packet composed of a Template  
    FlowSet, of a Data FlowSet (composed of 3 Flow Records), of one  
    Option Template and of one Option Data FlowSet (composed of 2  
    Records)  
 
 
 
 
 
 
 
Claise                      Informational                   [Page 23] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
    Export Packet: 
    +--------+---------------------------------------. . . 
    |        | +--------------+ +------------------+  
    | Packet | | Template     | | Data             |  
    | Header | | FlowSet      | | FlowSet          |   . . . 
    |        | | (1 Template) | | (3 Flow Records) |  
    |        | +--------------+ +------------------+  
    +--------+---------------------------------------. . . 
 
              . . .+-------------------------------------------+ 
                   +------------------+ +------------------+ | 
                   | Option           | | Option           | | 
              . . .| Template FlowSet | | Data FlowSet     | | 
                   | (1 Template)     | | (2 Records)      | | 
                   +------------------+ +------------------+ | 
              . . .-------------------------------------------+ 
 
    
10.1 Packet Header Example 
    
   The Packet Header is composed of: 
 
    0                   1                   2                   3 
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |     Version = 0x0009          |          Count = 7            | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                           sysUpTime                           | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                           Unix Secs                           | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                       Sequence Number                         | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                           Source ID                           | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    
    
10.2 Template FlowSet Example 
 
   We want to report the following Field Types: 
   - The source IP address (IPV4), so the length is 4 
   - The destination IP address (IPV4), so the length is 4 
   - The Next Hop IP address (IPV4), so the length is 4 

 
 
Claise                      Informational                   [Page 24] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
   - The number of bytes of the flow 
   - The number of packet of the flow 
 
   So the Template FlowSet will be composed of: 
 
     0                   1                   2                   3 
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |       FlowSet ID = 0          |      Length = 28 bytes        | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |       Template ID 256         |       Field Count = 5         | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |     IP_SRC_ADDR = 0x0008      |       Field Length = 4        | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |     IP_DST_ADDR = 0x000C      |       Field Length = 4        | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |     IP_NEXT_HOP = 0x000F      |       Field Length = 4        | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |       IN_PKTS = 0x0002        |       Field Length = 4        | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |       IN_BYTES = 0x0001       |       Field Length = 4        | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    
    
10.3 Data FlowSet Example 
 
   In this example, we are reporting the following 3 Flow records: 
 
   Src IP addr. | Dst IP addr. | Next Hop addr. | Packet | Bytes  
                                                | Number | Number 
 
 
   198.168.1.12 | 10.5.12.254  | 192.168.1.1    | 5009   | 5344385 
   192.168.1.27 | 10.5.12.23   | 192.168.1.1    | 748    | 388934 
   192.168.1.56 | 10.5.12.65   | 192.168.1.1    | 5      | 6534 
 
 
 
 
 
 
 
 
 
 
Claise                      Informational                   [Page 25] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
      0                   1                   2                   3 
      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |       FlowSet ID = 256        |          Length = 64          | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                          198.168.1.12                         | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                          10.5.12.254                          | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                          192.168.1.1                          | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                             5009                              | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                            5344385                            |  
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                          192.168.1.27                         | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                           10.5.12.23                          |  
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                          192.168.1.1                          | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                              748                              | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                             388934                            | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                          192.168.1.56                         | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                           10.5.12.65                          | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                           192.168.1.1                         | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                               5                               | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |                              6534                             | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 
    Note that padding was not necessary in this specific example. 
    
10.4 Option Template FlowSet Example 
    
   Per Line Card (the exporter being composed of 2 Line Cards), we want  
   to report the following Field Types: 
   - The total number of export packets 
 
 
Claise                      Informational                   [Page 26] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
 
   - The total number of exported flows  
 
   The format of the Options Template FlowSet is detailed below: 
 
      0                   1                   2                   3 
      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |       FlowSet ID = 1          |          Length = 24          | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |       Template ID 257         |    Option Scope Length = 4    | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |       Option Length = 8       |  Scope 1 Field Type = 0x0003  | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |   Scope 1 Field Length = 2    |   TOTAL_EXP_PKTS_SENT = 41    | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |       Field Length = 4        |     TOTAL_FLOWS_EXP = 42      | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |       Field Length = 4        |           Padding             | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    
10.5 Option Data FlowSet Example 
 
   In this example, we are reporting the following 2 records: 
 
   Line Card ID | Export Packet| Export Flow  
 
   Line Card 1  | 345          | 10201     
   Line Card 2  | 690          | 20402 
 
      0                   1                   2                   3 
      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |    FlowSet ID = 257           |         Length = 14           | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |             1                 |             345               | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |           10201               |              2                | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |             2                 |             690               | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     |           20402               |           Padding             | 
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 
 
Claise                      Informational                   [Page 27] 
           Cisco Systems NetFlow Services Export Version 9  June 2002 
 
 
 
11. References 
    
    [1]  "Management Information Base for Version 2 of the Simple  
         Network Management Protocol (SNMPv2)", RFC 1907, January 1996 
  
    [2]  "User Datagram Protocol", RFC 768, August 1980 
 
    [3]  "TRANSMISSION CONTROL PROTOCOL DARPA INTERNET PROGRAM PROTOCOL 
         SPECIFICATION", RFC 793, September 1981 
 
    [4]  "Stream Control Transmission Protocol", RFC 2960, October 2000 
    
    
12. Contributors 
    
   This document was written as a joint work between Vamsidhar Valluri 
   <vvalluri@cisco.com>, Martin Djernaes <djernaes@cisco.com> and Ganesh 
   Sadasivan <gsadasiv@cisco.com>. 
    
     
13. Acknowledgments 
    
   I would like to thank Pritam Shah for the good technical feedback. 
    
    
14. Author Addresses 
    
   Benoit Claise 
   Cisco Systems 
   De Kleetlaan 6a b1 
   1831 Diegem 
   Belgium 
   Phone: +32 2 704 5622 
   Email: bclaise@cisco.com 
 
    










 
 
Claise                      Informational                   [Page 28]