This is an old revision of the document!

Supported Template Fields

NetFlow v9 , v10 , and IPFIX use a template based architecture. This allows for flexibility in the metrics that are reported per flow. Each metric has a special Template ID and position as reported in special Template Packets sent periodically.

The following fields are supported by Trisul Network Analytics.

This list is not exhaustive and does not include special proprietary vendor specific template fields supported by Trisul.

Fields

IN_BYTES
IN_PKTS
FLOWS
PROTOCOL
SRC_TOS
TCP_FLAGS
L4_SRC_PORTreak;
IPV4_SRC_ADDR;
SRC_MASK
INPUT_SNMP;
L4_DST_PORTbreak;
IPV4_DST_ADDR;
DST_MASK
OUTPUT_SNMPak;
IPV4_NEXT_HOP
SRC_AS
DST_AS
BGP_IPV4_NEXT_HOP
MUL_DST_PKTS
MUL_DST_BYTES
LAST_SWITCHED
FIRST_SWITCHED;break;
OUT_BYTES
OUT_PKTS
MIN_PKT_LNGTH
MAX_PKT_LNGTH
IPV6_SRC_ADDR
IPV6_DST_ADDR
IPV6_SRC_MASK
IPV6_DST_MASK
IPV6_FLOW_LABEL
ICMP_TYPE
MUL_IGMP_TYPE
FLOW_SAMPLER_RANDOM_INTERVA/*50*/
SAMPLING_INTERVAL
IPV4_SRC_PREFIX
IPV4_DST_PREFIX
MPLS_TOP_LABEL_TYPE
MPLS_TOP_LABEL_IP_ADDR
DST_TOS
IN_SRC_MAC
OUT_DST_MAC
SRC_VLAN
DST_VLAN
IP_PROTOCOL_VERSION
DIRECTION
IPV6_NEXT_HOP
BPG_IPV6_NEXT_HOP
IPV6_OPTION_HEADERS
Vendor_Proprietary_69
MPLS_LABEL_1
MPLS_LABEL_2
MPLS_LABEL_3
MPLS_LABEL_4
MPLS_LABEL_5
MPLS_LABEL_6
MPLS_LABEL_7
MPLS_LABEL_8
MPLS_LABEL_9
MPLS_LABEL_10
IN_DST_MAC
OUT_SRC_MAC
IF_NAME
IF_DESC
SAMPLER_NAME
IN_PERMANENT_BYTES
IN_PERMANENT_PKTS
/*91-100*/
94:/*NBARapplicationDesc*/
95:/*NBARapplicationId*/
96:/*NBARapplicationName*/
DSCP_CODE_POINT:
VRF_ID:
136:flowEndReason- * 150: firstswitchedsecondsflowStartSeconds
151: lastswitchedsecondsflowEndSeconds * 152: flowstartms
153: flowendms * 225:/*postNATsource*/ * 226:/*postNATdestination*/ * 227:/*postNATSourceIPv4Port*/ * 228:/*postNATDestIPv4Port*/ * 230:/*natevent*/ * /*ASA*/ * 231/*NF_F_FWD_FLOW_DELTA_BYTES*/: * 232/*NF_F_REV_FLOW_DELTA_BYTES*/: * 323/*NF_F_EVENT_TIME_MSEC*/: * /*IPFixsamplertemplatefields-onlyinterestedinsamplingrate*/ * 305:/*samplingPacketInterval*/ * 346:/*PEN*/ nf9r.pen=(uint32_t)GetVarInt(fld.length,pptr);break; * * /*FNFfieldsfromoptionstemplate*/ * 15610:/*Scope0*/break; * 15611:/*Scope0*/ * Nbarf.scope0=(uint32_t)GetVarInt(fld.length,pptr); * break; * /*PENVeloCloud*/ * 32769:nf9r.byte_count_out=(uint64_t)GetVarInt(fld.length,pptr);break; * 32770:nf9r.packet_count_out=(uint64_t)GetVarInt(fld.length,pptr);break; * /*NOKIAISPTRAI..NATcustomeraddressforlogging*/ * /*looklikeLSN@10.140.242.61*/ * 32861: * /*NBARfields*/ * 45000:“applicationcategory”;
45001:“applicationsubcategory”; * 45002:“applicationgroup”;
45003:“applicationHTTPhost”varlen * /*paloAltoPEN-25461specific*/ * 56701:paloappid32bytes
56702:palouser64bytes