netflow:templatefields
This is an old revision of the document!
Supported Template Fields
NetFlow v9 , v10 , and IPFIX use a template based architecture. This allows for flexibility in the metrics that are reported per flow. Each metric has a special Template ID and position as reported in special Template Packets sent periodically.
The following fields are supported by Trisul Network Analytics.
This list is not exhaustive and does not include special proprietary vendor specific template fields supported by Trisul.
| Field Name | Description |
|---|---|
| IN_BYTES | traffic metric |
| IN_PKTS | traffic metric |
| FLOWS | traffic metric |
| PROTOCOL | L4 protocol |
| SRC_TOS | Type of Service byte setting when entering ingress interface |
| TCP_FLAGS | TCP Flags ORed |
| L4_SRC_PORT | source tcp/udp port |
| IPV4_SRC_ADDR | source address IPv4 |
| SRC_MASK | source address mask based on routing table |
| INPUT_SNMP | input interface |
| L4_DST_PORT | |
| IPV4_DST_ADDR | |
| DST_MASK | |
| OUTPUT_SNMP | |
| IPV4_NEXT_HOP | |
| SRC_AS | |
| DST_AS | |
| BGP_IPV4_NEXT_HOP | |
| MUL_DST_PKTS | |
| MUL_DST_BYTES | |
| LAST_SWITCHED | |
| FIRST_SWITCHED | |
| OUT_BYTES | |
| OUT_PKTS | |
| MIN_PKT_LNGTH | |
| MAX_PKT_LNGTH | |
| IPV6_SRC_ADDR | |
| IPV6_DST_ADDR | |
| IPV6_SRC_MASK | |
| IPV6_DST_MASK | |
| IPV6_FLOW_LABEL | |
| ICMP_TYPE | |
| MUL_IGMP_TYPE | |
| FLOW_SAMPLER_RANDOM_INTERVA /*50*/ | |
| SAMPLING_INTERVAL | |
| IPV4_SRC_PREFIX | |
| IPV4_DST_PREFIX | |
| MPLS_TOP_LABEL_TYPE | |
| MPLS_TOP_LABEL_IP_ADDR | |
| DST_TOS | |
| IN_SRC_MAC | |
| OUT_DST_MAC | |
| SRC_VLAN | |
| DST_VLAN | |
| IP_PROTOCOL_VERSION | |
| DIRECTION | |
| IPV6_NEXT_HOP | |
| BPG_IPV6_NEXT_HOP | |
| IPV6_OPTION_HEADERS | |
| Vendor_Proprietary_69 | |
| MPLS_LABEL_1 | |
| MPLS_LABEL_2 | |
| MPLS_LABEL_3 | |
| MPLS_LABEL_4 | |
| MPLS_LABEL_5 | |
| MPLS_LABEL_6 | |
| MPLS_LABEL_7 | |
| MPLS_LABEL_8 | |
| MPLS_LABEL_9 | |
| MPLS_LABEL_10 | |
| IN_DST_MAC | |
| OUT_SRC_MAC | |
| IF_NAME | |
| IF_DESC | |
| SAMPLER_NAME | |
| IN_PERMANENT_BYTES | |
| IN_PERMANENT_PKTS | |
| NBARapplicationDesc | |
| NBARapplicationId | |
| NBARapplicationName | |
| DSCP_CODE_POINT | |
| VRF_ID | |
| flowEndReason | |
| firstswitchedsecondsflowStartSeconds | |
| lastswitchedsecondsflowEndSeconds | |
| flowstartms | |
| flowendms | |
| postNATsource | |
| postNATdestination | |
| postNATSourceIPv4Port | |
| postNATDestIPv4Port | |
| natevent | |
| NF_F_FWD_FLOW_DELTA_BYTES | |
| NF_F_REV_FLOW_DELTA_BYTES | |
| NF_F_EVENT_TIME_MSEC | |
| samplingPacketInterval | |
| PEN nf9r.pen=(uint32_t)GetVarInt(fld.length,pptr) | |
| Scope0 | |
| Scope0 Nbarf.scope0=(uint32_t)GetVarInt(fld.length,pptr) | |
| byte_count_out=(uint64_t)GetVarInt(fld.length,pptr) | |
| packet_count_out=(uint64_t)GetVarInt(fld.length,pptr) | |
| applicationcategory | |
| applicationsubcategory | |
| applicationgroup | |
| applicationHTTPhost varlen | |
| paloappid32bytes | |
| palouser64bytes |
netflow/templatefields.1739448718.txt.gz · Last modified: 2025/02/13 17:41 by veera