NetFlow v9 , v10 , and IPFIX use a template based architecture. This allows for flexibility in the metrics that are reported per flow. Each metric has a special Template ID and position as reported in special Template Packets sent periodically.

The following fields are supported by Trisul Network Analytics.

IN_BYTES IN_PKTS FLOWS PROTOCOL SRC_TOS TCP_FLAGS L4_SRC_PORTreak; IPV4_SRC_ADDR; SRC_MASK INPUT_SNMP; L4_DST_PORTbreak; IPV4_DST_ADDR; DST_MASK OUTPUT_SNMPak; IPV4_NEXT_HOP SRC_AS DST_AS BGP_IPV4_NEXT_HOP MUL_DST_PKTS MUL_DST_BYTES LAST_SWITCHED FIRST_SWITCHED;break; OUT_BYTES OUT_PKTS MIN_PKT_LNGTH MAX_PKT_LNGTH IPV6_SRC_ADDR IPV6_DST_ADDR IPV6_SRC_MASK IPV6_DST_MASK IPV6_FLOW_LABEL ICMP_TYPE MUL_IGMP_TYPE FLOW_SAMPLER_RANDOM_INTERVA/*50*/ SAMPLING_INTERVAL IPV4_SRC_PREFIX IPV4_DST_PREFIX MPLS_TOP_LABEL_TYPE MPLS_TOP_LABEL_IP_ADDR DST_TOS IN_SRC_MAC OUT_DST_MAC SRC_VLAN DST_VLAN IP_PROTOCOL_VERSION DIRECTION IPV6_NEXT_HOP BPG_IPV6_NEXT_HOP IPV6_OPTION_HEADERS Vendor_Proprietary_69 MPLS_LABEL_1 MPLS_LABEL_2 MPLS_LABEL_3 MPLS_LABEL_4 MPLS_LABEL_5 MPLS_LABEL_6 MPLS_LABEL_7 MPLS_LABEL_8 MPLS_LABEL_9 MPLS_LABEL_10 IN_DST_MAC OUT_SRC_MAC IF_NAME IF_DESC SAMPLER_NAME IN_PERMANENT_BYTES IN_PERMANENT_PKTS /*91-100*/ 94:/*NBARapplicationDesc*/ 95:/*NBARapplicationId*/ 96:/*NBARapplicationName*/ DSCP_CODE_POINT: VRF_ID: 136:flowEndReason- 150: firstswitchedsecondsflowStartSeconds 151: lastswitchedsecondsflowEndSeconds 152: flowstartms 153: flowendms 225:/*postNATsource*/ 226:/*postNATdestination*/ 227:/*postNATSourceIPv4Port*/ 228:/*postNATDestIPv4Port*/ 230:/*natevent*/ /*ASA*/ 231/*NF_F_FWD_FLOW_DELTA_BYTES*/: 232/*NF_F_REV_FLOW_DELTA_BYTES*/: 323/*NF_F_EVENT_TIME_MSEC*/: /*IPFixsamplertemplatefields-onlyinterestedinsamplingrate*/ 305:/*samplingPacketInterval*/ 346:/*PEN*/ nf9r.pen=(uint32_t)GetVarInt(fld.length,pptr);break; /*FNFfieldsfromoptionstemplate*/ 15610:/*Scope0*/break; 15611:/*Scope0*/ Nbarf.scope0=(uint32_t)GetVarInt(fld.length,pptr); break; /*PENVeloCloud*/ 32769:nf9r.byte_count_out=(uint64_t)GetVarInt(fld.length,pptr);break; 32770:nf9r.packet_count_out=(uint64_t)GetVarInt(fld.length,pptr);break; /*NOKIAISPTRAI..NATcustomeraddressforlogging*/ /*looklikeLSN@10.140.242.61*/ 32861: /*NBARfields*/ 45000:“applicationcategory”; 45001:“applicationsubcategory”; 45002:“applicationgroup”; 45003:“applicationHTTPhost”varlen /*paloAltoPEN-25461specific*/ 56701:paloappid32bytes 56702:palouser64bytes