IPFIX
The IP Flow Information Export is an IETF-standardized protocol for exporting flow-based traffic data from routers, switches, and other network devices. It is an evolution of NetFlow, offering greater flexibility by supporting custom fields and templates for diverse network monitoring, security, and analytics applications. IPFIX allows vendors to define and export additional data types beyond traditional NetFlow fields.
Versions
The ipfix device collects IPFIX, and also NetFlow v9. The two share a template-based encoding — IPFIX standardized what v9 introduced — so one collector handles both. Legacy NetFlow v5 is collected by the netflow device instead.
| Field | Description |
|---|---|
sourceIPv4Address | Source IP address (IPv4) |
destinationIPv4Address | Destination IP address (IPv4) |
sourceIPv6Address | Source IP address (IPv6) |
destinationIPv6Address | Destination IP address (IPv6) |
sourceTransportPort | Source port number |
destinationTransportPort | Destination port number |
protocolIdentifier | Transport protocol (TCP, UDP, etc.) |
packetDeltaCount | Number of packets in the flow |
octetDeltaCount | Total bytes transferred |
flowStartMilliseconds | Start timestamp in milliseconds |
flowEndMilliseconds | End timestamp in milliseconds |
tcpControlBits | TCP control flags |
ipClassOfService | Type of Service (QoS marking) |
bgpSourceAsNumber | Source BGP Autonomous System (AS) number |
bgpDestinationAsNumber | Destination BGP AS number |
flowEndReason | Reason the flow ended, such as a timeout or a TCP FIN. Decoded but not emitted |
Byte and packet counts are read from the delta elements above. The cumulative variants octetTotalCount and packetTotalCount are decoded but not mapped, so an exporter that sends only those reports a flow with no byte or packet count.
Enterprise-specific information elements—those carrying a Private Enterprise Number—are recognized and skipped.
The information elements above are those carried on the wire. They are not the field names that reach a pipeline: the collector converts each record to ECS 8.11.0 before emitting it, so a flow arrives as source.ip, destination.port, network.bytes and their siblings.
IPFIX extends NetFlow by supporting variable-length fields and user-defined templates.