netflow:templatefields
This is an old revision of the document!
Supported Template Fields
NetFlow v9 , v10 , and IPFIX use a template based architecture. This allows for flexibility in the metrics that are reported per flow. Each metric has a special Template ID and position as reported in special Template Packets sent periodically.
The following fields are supported by Trisul Network Analytics.
This list is not exhaustive and does not include special proprietary vendor specific template fields supported by Trisul.
| Field Name | Description |
|---|---|
| IN_BYTES | |
| IN_PKTS | |
| FLOWS | |
| PROTOCOL | |
| SRC_TOS | |
| TCP_FLAGS | |
| L4_SRC_PORT | |
| IPV4_SRC_ADDR | |
| SRC_MASK | |
| INPUT_SNMP | |
| L4_DST_PORT | |
| IPV4_DST_ADDR | |
| DST_MASK | |
| OUTPUT_SNMP | |
| IPV4_NEXT_HOP | |
| SRC_AS | |
| DST_AS | |
| BGP_IPV4_NEXT_HOP | |
| MUL_DST_PKTS | |
| MUL_DST_BYTES | |
| LAST_SWITCHED | |
| FIRST_SWITCHED | |
| OUT_BYTES | |
| OUT_PKTS | |
| MIN_PKT_LNGTH | |
| MAX_PKT_LNGTH | |
| IPV6_SRC_ADDR | |
| IPV6_DST_ADDR | |
| IPV6_SRC_MASK | |
| IPV6_DST_MASK | |
| IPV6_FLOW_LABEL | |
| ICMP_TYPE | |
| MUL_IGMP_TYPE | |
| FLOW_SAMPLER_RANDOM_INTERVA /*50*/ | |
| SAMPLING_INTERVAL | |
| IPV4_SRC_PREFIX | |
| IPV4_DST_PREFIX | |
| MPLS_TOP_LABEL_TYPE | |
| MPLS_TOP_LABEL_IP_ADDR | |
| DST_TOS | |
| IN_SRC_MAC | |
| OUT_DST_MAC | |
| SRC_VLAN | |
| DST_VLAN | |
| IP_PROTOCOL_VERSION | |
| DIRECTION | |
| IPV6_NEXT_HOP | |
| BPG_IPV6_NEXT_HOP | |
| IPV6_OPTION_HEADERS | |
| Vendor_Proprietary_69 | |
| MPLS_LABEL_1 | |
| MPLS_LABEL_2 | |
| MPLS_LABEL_3 | |
| MPLS_LABEL_4 | |
| MPLS_LABEL_5 | |
| MPLS_LABEL_6 | |
| MPLS_LABEL_7 | |
| MPLS_LABEL_8 | |
| MPLS_LABEL_9 | |
| MPLS_LABEL_10 | |
| IN_DST_MAC | |
| OUT_SRC_MAC | |
| IF_NAME | |
| IF_DESC | |
| SAMPLER_NAME | |
| IN_PERMANENT_BYTES | |
| IN_PERMANENT_PKTS | |
| NBARapplicationDesc | |
| NBARapplicationId | |
| NBARapplicationName | |
| DSCP_CODE_POINT | |
| VRF_ID | |
| flowEndReason | |
| firstswitchedsecondsflowStartSeconds | |
| lastswitchedsecondsflowEndSeconds | |
| flowstartms | |
| flowendms | |
| postNATsource | |
| postNATdestination | |
| postNATSourceIPv4Port | |
| postNATDestIPv4Port | |
| natevent | |
| NF_F_FWD_FLOW_DELTA_BYTES | |
| NF_F_REV_FLOW_DELTA_BYTES | |
| NF_F_EVENT_TIME_MSEC | |
| samplingPacketInterval | |
| PEN nf9r.pen=(uint32_t)GetVarInt(fld.length,pptr) | |
| Scope0 | |
| Scope0 Nbarf.scope0=(uint32_t)GetVarInt(fld.length,pptr) | |
| byte_count_out=(uint64_t)GetVarInt(fld.length,pptr) | |
| packet_count_out=(uint64_t)GetVarInt(fld.length,pptr) | |
| applicationcategory | |
| applicationsubcategory | |
| applicationgroup | |
| applicationHTTPhost varlen | |
| paloappid32bytes | |
| palouser64bytes |
netflow/templatefields.1739365529.txt.gz · Last modified: 2025/02/12 18:35 by vignesh