NetFlow
A network protocol developed by Cisco for collecting, analyzing, and monitoring network traffic. It captures metadata about IP traffic flows, providing insights into bandwidth usage, security threats, and network performance.
Versions
The netflow device collects NetFlow v5, the fixed-format legacy record. Datagrams declaring any other version are rejected.
NetFlow v9 is collected by the ipfix device, not this one. v9 introduced the template-based encoding that IPFIX later standardized, so DataStream handles both with the same collector.
Packet Header
Every v5 datagram opens with a header describing the flows that follow.
| Field | Description |
|---|---|
Version | Always 5 |
Count | Number of flow records in this datagram |
SysUptime | Milliseconds since the exporter booted |
UnixSecs | Exporter clock, seconds since the epoch |
UnixNSecs | Residual nanoseconds |
FlowSequence | Running count of flows exported, for loss detection |
EngineType | Type of the switching engine |
EngineId | Slot number of the switching engine |
SamplingInterval | Sampling mode and interval |
SysUptime and UnixSecs are what make the per-flow timestamps interpretable—see First and Last below.
Flow Record
Each datagram carries up to 30 of these fixed-layout records.
| Field | Description |
|---|---|
SrcAddr | Source IP address |
DstAddr | Destination IP address |
NextHop | IP address of the next hop router |
Input | SNMP index of the input interface |
Output | SNMP index of the output interface |
DPkts | Number of packets in the flow |
DOctets | Total bytes transferred |
First | Uptime in milliseconds at the first packet of the flow |
Last | Uptime in milliseconds at the last packet of the flow |
SrcPort | Source port number |
DstPort | Destination port number |
TCPFlags | Cumulative OR of the TCP flags seen |
Proto | IP protocol number |
Tos | Type of Service |
SrcAS | Source Autonomous System number |
DstAS | Destination Autonomous System number |
SrcMask | Source address prefix length |
DstMask | Destination address prefix length |
First and Last are relative to SysUptime, not absolute times. Converting them to timestamps requires the header's SysUptime and UnixSecs.
Emitted Fields
The names above are those of the NetFlow record on the wire. They are not the field names that reach a pipeline: the collector converts each record to ECS 8.11.0 before emitting it, so a flow arrives as source.ip, destination.port, network.bytes and their siblings.