the data in the Flow Record. The format of the Template FlowSet is
as follows:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = 0 | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID 256 | Field Count |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type 1 | Field Length 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type 2 | Field Length 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type N | Field Length N |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID 257 | Field Count |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type 1 | Field Length 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type 2 | Field Length 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Field Type M | Field Length M |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID K | Field Count |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Template FlowSet Field Descriptions
FlowSet ID
FlowSet ID value of 0 is reserved for the Template FlowSet.
Length
Total length of this FlowSet. Because an individual Template
FlowSet MAY contain multiple Template Records, the Length value
MUST be used to determine the position of the next FlowSet
record, which could be any type of FlowSet. Length is the sum
of the lengths of the FlowSet ID, the Length itself, and all
Template Records within this FlowSet.
Template ID
Each of the newly generated Template Records is given a unique
Template ID. This uniqueness is local to the Observation
Domain that generated the Template ID. Template IDs 0-255 are
reserved for Template FlowSets, Options FlowSets, and other
reserved FlowSets yet to be created. Template IDs of Data
FlowSets are numbered from 256 to 65535.
Field Count
Number of fields in this Template Record. Because a Template
FlowSet usually contains multiple Template Records, this field
allows the Collector to determine the end of the current
Template Record and the start of the next.
Field Type
A numeric value that represents the type of the field. Refer
to the "Field Type Definitions" section.
Field Length
The length of the corresponding Field Type, in bytes. Refer to
the "Field Type Definitions" section.
5.3. Data FlowSet Format
The format of the Data FlowSet is as follows:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = Template ID | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1 - Field Value 1 | Record 1 - Field Value 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1 - Field Value 3 | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2 - Field Value 1 | Record 2 - Field Value 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2 - Field Value 3 | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 3 - Field Value 1 | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Data FlowSet Field Descriptions
FlowSet ID = Template ID
Each Data FlowSet is associated with a FlowSet ID. The FlowSet
ID maps to a (previously generated) Template ID. The Collector
MUST use the FlowSet ID to find the corresponding Template
Record and decode the Flow Records from the FlowSet.
Length
The length of this FlowSet. Length is the sum of the lengths
of the FlowSet ID, Length itself, all Flow Records within this
FlowSet, and the padding bytes, if any.
Record N - Field Value M
The remainder of the Data FlowSet is a collection of Flow Data
Record(s), each containing a set of field values. The Type and
Length of the fields have been previously defined in the
Template Record referenced by the FlowSet ID or Template ID.
Padding
The Exporter SHOULD insert some padding bytes so that the
subsequent FlowSet starts at a 4-byte aligned boundary. It is
important to note that the Length field includes the padding
bytes. Padding SHOULD be using zeros.
Interpretation of the Data FlowSet format can be done only if the
Template FlowSet corresponding to the Template ID is available at the
Collector.
6. Options
6.1. Options Template FlowSet Format
The Options Template Record (and its corresponding Options Data
Record) is used to supply information about the NetFlow process
configuration or NetFlow process specific data, rather than supplying
information about IP Flows.
For example, the Options Template FlowSet can report the sample rate
of a specific interface, if sampling is supported, along with the
sampling method used.
The format of the Options Template FlowSet follows.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = 1 | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Template ID | Option Scope Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option Length | Scope 1 Field Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope 1 Field Length | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Scope N Field Length | Option 1 Field Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option 1 Field Length | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option M Field Length | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Options Template FlowSet Field Definitions
FlowSet ID = 1
A FlowSet ID value of 1 is reserved for the Options Template.
Length
Total length of this FlowSet. Each Options Template FlowSet
MAY contain multiple Options Template Records. Thus, the
Length value MUST be used to determine the position of the next
FlowSet record, which could be either a Template FlowSet or
Data FlowSet.
Length is the sum of the lengths of the FlowSet ID, the Length
itself, and all Options Template Records within this FlowSet
Template ID.
Template ID
Template ID of this Options Template. This value is greater
than 255.
Option Scope Length
The length in bytes of any Scope field definition contained in
the Options Template Record (The use of "Scope" is described
below).
Option Length
The length (in bytes) of any options field definitions
contained in this Options Template Record.
Scope 1 Field Type
The relevant portion of the Exporter/NetFlow process to which
the Options Template Record refers.
Currently defined values are:
1 System
2 Interface
3 Line Card
4 Cache
5 Template
For example, the NetFlow process can be implemented on a per-
interface basis, so if the Options Template Record were
reporting on how the NetFlow process is configured, the Scope
for the report would be 2 (interface). The associated
interface ID would then be carried in the associated Options
Data FlowSet. The Scope can be limited further by listing
multiple scopes that all must match at the same time. Note
that the Scope fields always precede the Option fields.
Scope 1 Field Length
The length (in bytes) of the Scope field, as it would appear in
an Options Data Record.
Option 1 Field Type
A numeric value that represents the type of field that would
appear in the Options Template Record. Refer to the Field Type
Definitions section.
Option 1 Field Length
The length (in bytes) of the Option field.
Padding
The Exporter SHOULD insert some padding bytes so that the
subsequent FlowSet starts at a 4-byte aligned boundary. It is
important to note that the Length field includes the padding
bytes. Padding SHOULD be using zeros.
6.2. Options Data Record Format
The Options Data Records are sent in Data FlowSets, on a regular
basis, but not with every Flow Data Record. How frequently these
Options Data Records are exported is configurable. See the
"Templates Management" section for more details.
The format of the Data FlowSet containing Options Data Records
follows.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FlowSet ID = Template ID | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 1 - Scope 1 Value |Record 1 - Option Field 1 Value|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Record 1 - Option Field 2 Value| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 2 - Scope 1 Value |Record 2 - Option Field 1 Value|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Record 2 - Option Field 2 Value| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record 3 - Scope 1 Value |Record 3 - Option Field 1 Value|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Record 3 - Option Field 2 Value| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Options Data Records of the Data FlowSet Field Descriptions
FlowSet ID = Template ID
A FlowSet ID precedes each group of Options Data Records within
a Data FlowSet. The FlowSet ID maps to a previously generated
Template ID corresponding to this Options Template Record. The
Collector MUST use the FlowSet ID to map the appropriate type
and length to any field values that follow.
Length
The length of this FlowSet. Length is the sum of the lengths of
the FlowSet ID, Length itself, all the Options Data Records
within this FlowSet, and the padding bytes, if any.
Record N - Option Field M Value
The remainder of the Data FlowSet is a collection of Flow
Records, each containing a set of scope and field values. The
type and length of the fields were previously defined in the
Options Template Record referenced by the FlowSet ID or
Template ID.
Padding
The Exporter SHOULD insert some padding bytes so that the
subsequent FlowSet starts at a 4-byte aligned boundary. It is
important to note that the Length field includes the padding
bytes. Padding SHOULD be using zeros.
The Data FlowSet format can be interpreted only if the Options
Template FlowSet corresponding to the Template ID is available at the
Collector.
7. Template Management
Flow Data records that correspond to a Template Record MAY appear in
the same and/or subsequent Export Packets. The Template Record is
not necessarily carried in every Export Packet. As such, the NetFlow
Collector MUST store the Template Record to interpret the
corresponding Flow Data Records that are received in subsequent data
packets.
A NetFlow Collector that receives Export Packets from several
Observation Domains from the same Exporter MUST be aware that the
uniqueness of the Template ID is not guaranteed across Observation
Domains.
The Template IDs must remain constant for the life of the NetFlow
process on the Exporter. If the Exporter or the NetFlow process
restarts for any reason, all information about Templates will be lost
and new Template IDs will be created. Template IDs are thus not
guaranteed to be consistent across an Exporter or NetFlow process
restart.
A newly created Template record is assigned an unused Template ID
from the Exporter. If the template configuration is changed, the
current Template ID is abandoned and SHOULD NOT be reused until the
NetFlow process or Exporter restarts. If a Collector should receive
a new definition for an already existing Template ID, it MUST discard
the previous template definition and use the new one.
If a configured Template Record on the Exporter is deleted, and re-
configured with exactly the same parameters, the same Template ID
COULD be reused.
The Exporter sends the Template FlowSet and Options Template FlowSet
under the following conditions:
1. After a NetFlow process restarts, the Exporter MUST NOT send any
Data FlowSet without sending the corresponding Template FlowSet
and the required Options Template FlowSet in a previous packet or
including it in the same Export Packet. It MAY transmit the
Template FlowSet and Options Template FlowSet, without any Data
FlowSets, in advance to help ensure that the Collector will have
the correct Template Record before receiving the first Flow or
Options Data Record.
2. In the event of configuration changes, the Exporter SHOULD send
the new template definitions at an accelerated rate. In such a
case, it MAY transmit the changed Template Record(s) and Options
Template Record(s), without any data, in advance to help ensure
that the Collector will have the correct template information
before receiving the first data.
3. On a regular basis, the Exporter MUST send all the Template
Records and Options Template Records to refresh the Collector.
Template IDs have a limited lifetime at the Collector and MUST be
periodically refreshed. Two approaches are taken to make sure
that Templates get refreshed at the Collector:
* Every N number of Export Packets.
* On a time basis, so every N number of minutes.
Both options MUST be configurable by the user on the Exporter.
When one of these expiry conditions is met, the Exporter MUST send
the Template FlowSet and Options Template.
4. In the event of a clock configuration change on the Exporter, the
Exporter SHOULD send the template definitions at an accelerated
rate.
8. Field Type Definitions
The following table describes all the field type definitions that an
Exporter MAY support. The fields are a selection of Packet Header
fields, lookup results (for example, the autonomous system numbers or
the subnet masks), and properties of the packet such as length.
Field Type Value Length Description
(bytes)
Incoming counter with
length N x 8 bits for the
IN_BYTES 1 N number of bytes associated
with an IP Flow. By default
N is 4
Incoming counter with
length N x 8 bits for the
IN_PKTS 2 N number of packets
associated with an IP Flow.
By default N is 4
FLOWS 3 N Number of Flows
that were aggregated;
by default N is 4
PROTOCOL 4 1 IP protocol byte
Type of service byte
TOS 5 1 setting when entering
the incoming interface
TCP flags; cumulative of
TCP_FLAGS 6 1 all the TCP flags seen in
this Flow
TCP/UDP source port number
L4_SRC_PORT 7 2 (for example, FTP, Telnet,
or equivalent)
IPV4_SRC_ADDR 8 4 IPv4 source address
The number of contiguous
bits in the source subnet
SRC_MASK 9 1 mask (i.e., the mask in
slash notation)
Input interface index.
INPUT_SNMP 10 N By default N is 2, but