Netflow IEs
The Unified Flow Collector supports Netflow versions 1, 5, 6, 7 and 9 records.
Netflow v1
The Unified Flow Collector supports 14 unique Netflow v1 information elements (IE).
Name | Community | Basic | Standard | Premium |
---|---|---|---|---|
srcaddr | ✓ | ✓ | ✓ | ✓ |
dstaddr | ✓ | ✓ | ✓ | ✓ |
nexthop | ✓ | ✓ | ✓ | ✓ |
input | ✓ | ✓ | ✓ | ✓ |
output | ✓ | ✓ | ✓ | ✓ |
dPkts | ✓ | ✓ | ✓ | ✓ |
dOctets | ✓ | ✓ | ✓ | ✓ |
First | ✓ | ✓ | ✓ | ✓ |
Last | ✓ | ✓ | ✓ | ✓ |
srcport | ✓ | ✓ | ✓ | ✓ |
dstport | ✓ | ✓ | ✓ | ✓ |
prot | ✓ | ✓ | ✓ | ✓ |
tos | ✓ | ✓ | ✓ | ✓ |
tcp_flags | ✓ | ✓ | ✓ | ✓ |
Netflow v5
The Unified Flow Collector support 18 unique Netflow v5 information elements (IE).
Name | Community | Basic | Standard | Premium |
---|---|---|---|---|
srcaddr | ✓ | ✓ | ✓ | ✓ |
dstaddr | ✓ | ✓ | ✓ | ✓ |
nexthop | ✓ | ✓ | ✓ | ✓ |
input | ✓ | ✓ | ✓ | ✓ |
output | ✓ | ✓ | ✓ | ✓ |
dPkts | ✓ | ✓ | ✓ | ✓ |
dOctets | ✓ | ✓ | ✓ | ✓ |
First | ✓ | ✓ | ✓ | ✓ |
Last | ✓ | ✓ | ✓ | ✓ |
srcport | ✓ | ✓ | ✓ | ✓ |
dstport | ✓ | ✓ | ✓ | ✓ |
tcp_flags | ✓ | ✓ | ✓ | ✓ |
prot | ✓ | ✓ | ✓ | ✓ |
tos | ✓ | ✓ | ✓ | ✓ |
src_as | ✓ | ✓ | ✓ | ✓ |
dst_as | ✓ | ✓ | ✓ | ✓ |
src_mask | ✓ | ✓ | ✓ | ✓ |
dst_mask | ✓ | ✓ | ✓ | ✓ |
Netflow v6
The Unified Flow Collector support 18 unique Netflow v6 information elements (IE).
Name | Community | Basic | Standard | Premium |
---|---|---|---|---|
srcaddr | ✓ | ✓ | ✓ | ✓ |
dstaddr | ✓ | ✓ | ✓ | ✓ |
nexthop | ✓ | ✓ | ✓ | ✓ |
input | ✓ | ✓ | ✓ | ✓ |
output | ✓ | ✓ | ✓ | ✓ |
dPkts | ✓ | ✓ | ✓ | ✓ |
dOctets | ✓ | ✓ | ✓ | ✓ |
First | ✓ | ✓ | ✓ | ✓ |
Last | ✓ | ✓ | ✓ | ✓ |
srcport | ✓ | ✓ | ✓ | ✓ |
dstport | ✓ | ✓ | ✓ | ✓ |
tcp_flags | ✓ | ✓ | ✓ | ✓ |
prot | ✓ | ✓ | ✓ | ✓ |
tos | ✓ | ✓ | ✓ | ✓ |
src_as | ✓ | ✓ | ✓ | ✓ |
dst_as | ✓ | ✓ | ✓ | ✓ |
src_mask | ✓ | ✓ | ✓ | ✓ |
dst_mask | ✓ | ✓ | ✓ | ✓ |
Netflow v7
The Unified Flow Collector support 19 unique Netflow v7 information elements (IE).
Name | Community | Basic | Standard | Premium |
---|---|---|---|---|
srcaddr | ✓ | ✓ | ✓ | ✓ |
dstaddr | ✓ | ✓ | ✓ | ✓ |
nexthop | ✓ | ✓ | ✓ | ✓ |
input | ✓ | ✓ | ✓ | ✓ |
output | ✓ | ✓ | ✓ | ✓ |
dPkts | ✓ | ✓ | ✓ | ✓ |
dOctets | ✓ | ✓ | ✓ | ✓ |
First | ✓ | ✓ | ✓ | ✓ |
Last | ✓ | ✓ | ✓ | ✓ |
srcport | ✓ | ✓ | ✓ | ✓ |
dstport | ✓ | ✓ | ✓ | ✓ |
tcp_flags | ✓ | ✓ | ✓ | ✓ |
prot | ✓ | ✓ | ✓ | ✓ |
tos | ✓ | ✓ | ✓ | ✓ |
src_as | ✓ | ✓ | ✓ | ✓ |
dst_as | ✓ | ✓ | ✓ | ✓ |
src_mask | ✓ | ✓ | ✓ | ✓ |
dst_mask | ✓ | ✓ | ✓ | ✓ |
ipv4RouterSc | ✓ | ✓ | ✓ | ✓ |
Netflow v9
The Unified Flow Collector supports over 1500 unique Netflow v9 information elements (IE).
PEN | Vendor | IEs |
---|---|---|
0 | IANA | 462 |
9 | Cisco | 581 |
193 | Ericsson | 8 |
4056 | StreamCORE | 28 |
4321 | Riverbed | 12 |
8712 | LANcope (Cisco) | 43 |
25461 | Palo Alto Networks | 2 |
33610 | FastIP / Boundary | 23 |
35632 | ntop | 370 |
40842 | A10 Networks | 15 |
Standards-based IEs (PEN: 0)
ID | Name | Community | Basic | Standard | Premium |
---|---|---|---|---|---|
1 | octetDeltaCount | ✓ | ✓ | ✓ | ✓ |
2 | packetDeltaCount | ✓ | ✓ | ✓ | ✓ |
3 | deltaFlowCount | ✓ | ✓ | ✓ | ✓ |
4 | protocolIdentifier | ✓ | ✓ | ✓ | ✓ |
5 | ipClassOfService | ✓ | ✓ | ✓ | ✓ |
6 | tcpControlBits | ✓ | ✓ | ✓ | ✓ |
7 | sourceTransportPort | ✓ | ✓ | ✓ | ✓ |
8 | sourceIPv4Address | ✓ | ✓ | ✓ | ✓ |
9 | sourceIPv4PrefixLength | ✓ | ✓ | ✓ | ✓ |
10 | ingressInterface | ✓ | ✓ | ✓ | ✓ |
11 | destinationTransportPort | ✓ | ✓ | ✓ | ✓ |
12 | destinationIPv4Address | ✓ | ✓ | ✓ | ✓ |
13 | destinationIPv4PrefixLength | ✓ | ✓ | ✓ | ✓ |
14 | egressInterface | ✓ | ✓ | ✓ | ✓ |
15 | ipNextHopIPv4Address | ✓ | ✓ | ✓ | ✓ |
16 | bgpSourceAsNumber | ✓ | ✓ | ✓ | ✓ |
17 | bgpDestinationAsNumber | ✓ | ✓ | ✓ | ✓ |
18 | bgpNextHopIPv4Address | ✓ | ✓ | ✓ | ✓ |
19 | postMCastPacketDeltaCount | ✓ | ✓ | ✓ | ✓ |
20 | postMCastOctetDeltaCount | ✓ | ✓ | ✓ | ✓ |
21 | flowEndSysUpTime | ✓ | ✓ | ✓ | ✓ |
22 | flowStartSysUpTime | ✓ | ✓ | ✓ | ✓ |
23 | postOctetDeltaCount | ✓ | ✓ | ✓ | ✓ |
24 | postPacketDeltaCount | ✓ | ✓ | ✓ | ✓ |
25 | minimumIpTotalLength | ✓ | ✓ | ✓ | ✓ |
26 | maximumIpTotalLength | ✓ | ✓ | ✓ | ✓ |
27 | sourceIPv6Address | ✓ | ✓ | ✓ | ✓ |
28 | destinationIPv6Address | ✓ | ✓ | ✓ | ✓ |
29 | sourceIPv6PrefixLength | ✓ | ✓ | ✓ | ✓ |
30 | destinationIPv6PrefixLength | ✓ | ✓ | ✓ | ✓ |
31 | flowLabelIPv6 | ✓ | ✓ | ✓ | ✓ |
32 | icmpTypeCodeIPv4 | ✓ | ✓ | ✓ | ✓ |
33 | igmpType | ✓ | ✓ | ✓ | ✓ |
34 | samplingInterval | ✓ | ✓ | ✓ | ✓ |
35 | samplingAlgorithm | ✓ | ✓ | ✓ | ✓ |
36 | flowActiveTimeout | ✓ | ✓ | ✓ | ✓ |
37 | flowIdleTimeout | ✓ | ✓ | ✓ | ✓ |
38 | engineType | ✓ | ✓ | ✓ | ✓ |
39 | engineId | ✓ | ✓ | ✓ | ✓ |
40 | exportedOctetTotalCount | ✓ | ✓ | ✓ | ✓ |
41 | exportedMessageTotalCount | ✓ | ✓ | ✓ | ✓ |
42 | exportedFlowRecordTotalCount | ✓ | ✓ | ✓ | ✓ |
44 | sourceIPv4Prefix | ✓ | ✓ | ✓ | ✓ |
45 | destinationIPv4Prefix | ✓ | ✓ | ✓ | ✓ |
46 | mplsTopLabelType | ✓ | ✓ | ✓ | ✓ |
47 | mplsTopLabelIPv4Address | ✓ | ✓ | ✓ | ✓ |
48 | samplerId | ✓ | ✓ | ✓ | ✓ |
49 | samplerMode | ✓ | ✓ | ✓ | ✓ |
50 | samplerRandomInterval | ✓ | ✓ | ✓ | ✓ |
51 | classId | ✓ | ✓ | ✓ | ✓ |
52 | minimumTTL | ✓ | ✓ | ✓ | ✓ |
53 | maximumTTL | ✓ | ✓ | ✓ | ✓ |
54 | fragmentIdentification | ✓ | ✓ | ✓ | ✓ |
55 | postIpClassOfService | ✓ | ✓ | ✓ | ✓ |
56 | sourceMacAddress | ✓ | ✓ | ✓ | ✓ |
57 | postDestinationMacAddress | ✓ | ✓ | ✓ | ✓ |
58 | vlanId | ✓ | ✓ | ✓ | ✓ |
59 | postVlanId | ✓ | ✓ | ✓ | ✓ |
60 | ipVersion | ✓ | ✓ | ✓ | ✓ |
61 | flowDirection | ✓ | ✓ | ✓ | ✓ |
62 | ipNextHopIPv6Address | ✓ | ✓ | ✓ | ✓ |
63 | bgpNextHopIPv6Address | ✓ | ✓ | ✓ | ✓ |
64 | ipv6ExtensionHeaders | ✓ | ✓ | ✓ | ✓ |
65 | transportPacketLoss Cisco Legacy | ✓ | ✓ | ||
66 | transportUnreachability Cisco Legacy | ✓ | ✓ | ||
67 | transportLatency Cisco Legacy | ✓ | ✓ | ||
68 | dataPoints Cisco Legacy | ✓ | ✓ | ||
69 | variance Cisco Legacy | ✓ | ✓ | ||
70 | mplsTopLabelStackSection | ✓ | ✓ | ✓ | |
71 | mplsLabelStackSection2 | ✓ | ✓ | ✓ | |
72 | mplsLabelStackSection3 | ✓ | ✓ | ✓ | |
73 | mplsLabelStackSection4 | ✓ | ✓ | ✓ | |
74 | mplsLabelStackSection5 | ✓ | ✓ | ✓ | |
75 | mplsLabelStackSection6 | ✓ | ✓ | ✓ | |
76 | mplsLabelStackSection7 | ✓ | ✓ | ✓ | |
77 | mplsLabelStackSection8 | ✓ | ✓ | ✓ | |
78 | mplsLabelStackSection9 | ✓ | ✓ | ✓ | |
79 | mplsLabelStackSection10 | ✓ | ✓ | ✓ | |
80 | destinationMacAddress | ✓ | ✓ | ✓ | ✓ |
81 | postSourceMacAddress | ✓ | ✓ | ✓ | ✓ |
82 | interfaceName | ✓ | ✓ | ✓ | ✓ |
83 | interfaceDescription | ✓ | ✓ | ✓ | ✓ |
84 | samplerName | ✓ | ✓ | ✓ | ✓ |
85 | octetTotalCount | ✓ | ✓ | ✓ | ✓ |
86 | packetTotalCount | ✓ | ✓ | ✓ | ✓ |
87 | flagsAndSamplerId | ✓ | ✓ | ✓ | ✓ |
88 | fragmentOffset | ✓ | ✓ | ✓ | ✓ |
89 | forwardingStatus | ✓ | ✓ | ✓ | ✓ |
90 | mplsVpnRouteDistinguisher | ✓ | ✓ | ✓ | |
91 | mplsTopLabelPrefixLength | ✓ | ✓ | ✓ | |
92 | srcTrafficIndex | ✓ | ✓ | ✓ | |
93 | dstTrafficIndex | ✓ | ✓ | ✓ | |
94 | applicationDescription | ✓ | ✓ | ✓ | |
95 | applicationId | ✓ | ✓ | ✓ | |
96 | applicationName | ✓ | ✓ | ✓ | |
97 | subApplicationTag Cisco Legacy | ✓ | ✓ | ||
98 | postIpDiffServCodePoint | ✓ | ✓ | ✓ | |
99 | multicastReplicationFactor | ✓ | ✓ | ✓ | |
100 | className | ✓ | ✓ | ✓ | |
101 | classificationEngineId | ✓ | ✓ | ✓ | |
102 | layer2packetSectionOffset | ✓ | ✓ | ✓ | |
103 | layer2packetSectionSize | ✓ | ✓ | ✓ | |
104 | layer2packetSectionData | ✓ | ✓ | ✓ | |
105 | applicationVersion Cisco Legacy | ✓ | ✓ | ||
106 | applicationVersionName Cisco Legacy | ✓ | ✓ | ||
107 | applicationVendor Cisco Legacy | ✓ | ✓ | ||
109 | subApplicationName Cisco Legacy | ✓ | ✓ | ||
110 | subApplicationDescription Cisco Legacy | ✓ | ✓ | ||
111 | templateParameterRangeEnd Cisco Legacy | ✓ | ✓ | ||
128 | bgpNextAdjacentAsNumber | ✓ | ✓ | ✓ | |
129 | bgpPrevAdjacentAsNumber | ✓ | ✓ | ✓ | |
130 | exporterIPv4Address | ✓ | ✓ | ✓ | ✓ |
131 | exporterIPv6Address | ✓ | ✓ | ✓ | ✓ |
132 | droppedOctetDeltaCount | ✓ | ✓ | ✓ | |
133 | droppedPacketDeltaCount | ✓ | ✓ | ✓ | |
134 | droppedOctetTotalCount | ✓ | ✓ | ✓ | |
135 | droppedPacketTotalCount | ✓ | ✓ | ✓ | |
136 | flowEndReason | ✓ | ✓ | ✓ | |
137 | commonPropertiesId | ✓ | ✓ | ✓ | |
138 | observationPointId | ✓ | ✓ | ✓ | |
139 | icmpTypeCodeIPv6 | ✓ | ✓ | ✓ | |
140 | mplsTopLabelIPv6Address | ✓ | ✓ | ✓ | |
141 | lineCardId | ✓ | ✓ | ✓ | |
142 | portId | ✓ | ✓ | ✓ | |
143 | meteringProcessId | ✓ | ✓ | ✓ | |
144 | exportingProcessId | ✓ | ✓ | ✓ | |
145 | templateId | ✓ | ✓ | ✓ | |
146 | wlanChannelId | ✓ | ✓ | ✓ | |
147 | wlanSSID | ✓ | ✓ | ✓ | |
148 | flowId | ✓ | ✓ | ✓ | |
149 | observationDomainId | ✓ | ✓ | ✓ | |
150 | flowStartSeconds | ✓ | ✓ | ✓ | ✓ |
151 | flowEndSeconds | ✓ | ✓ | ✓ | ✓ |
152 | flowStartMilliseconds | ✓ | ✓ | ✓ | ✓ |
153 | flowEndMilliseconds | ✓ | ✓ | ✓ | ✓ |
154 | flowStartMicroseconds | ✓ | ✓ | ✓ | ✓ |
155 | flowEndMicroseconds | ✓ | ✓ | ✓ | ✓ |
156 | flowStartNanoseconds | ✓ | ✓ | ✓ | ✓ |
157 | flowEndNanoseconds | ✓ | ✓ | ✓ | ✓ |
158 | flowStartDeltaMicroseconds | ✓ | ✓ | ✓ | |
159 | flowEndDeltaMicroseconds | ✓ | ✓ | ✓ | |
160 | systemInitTimeMilliseconds | ✓ | ✓ | ✓ | |
161 | flowDurationMilliseconds | ✓ | ✓ | ✓ | |
162 | flowDurationMicroseconds | ✓ | ✓ | ✓ | |
163 | observedFlowTotalCount | ✓ | ✓ | ✓ | |
164 | ignoredPacketTotalCount | ✓ | ✓ | ✓ | |
165 | ignoredOctetTotalCount | ✓ | ✓ | ✓ | |
166 | notSentFlowTotalCount | ✓ | ✓ | ✓ | |
167 | notSentPacketTotalCount | ✓ | ✓ | ✓ | |
168 | notSentOctetTotalCount | ✓ | ✓ | ✓ | |
169 | destinationIPv6Prefix | ✓ | ✓ | ✓ | |
170 | sourceIPv6Prefix | ✓ | ✓ | ✓ | |
171 | postOctetTotalCount | ✓ | ✓ | ✓ | |
172 | postPacketTotalCount | ✓ | ✓ | ✓ | |
173 | flowKeyIndicator | ✓ | ✓ | ✓ | |
174 | postMCastPacketTotalCount | ✓ | ✓ | ✓ | |
175 | postMCastOctetTotalCount | ✓ | ✓ | ✓ | |
176 | icmpTypeIPv4 | ✓ | ✓ | ✓ | |
177 | icmpCodeIPv4 | ✓ | ✓ | ✓ | |
178 | icmpTypeIPv6 | ✓ | ✓ | ✓ | |
179 | icmpCodeIPv6 | ✓ | ✓ | ✓ | |
180 | udpSourcePort | ✓ | ✓ | ✓ | |
181 | udpDestinationPort | ✓ | ✓ | ✓ | |
182 | tcpSourcePort | ✓ | ✓ | ✓ | |
183 | tcpDestinationPort | ✓ | ✓ | ✓ | |
184 | tcpSequenceNumber | ✓ | ✓ | ✓ | |
185 | tcpAcknowledgementNumber | ✓ | ✓ | ✓ | |
186 | tcpWindowSize | ✓ | ✓ | ✓ | |
187 | tcpUrgentPointer | ✓ | ✓ | ✓ | |
188 | tcpHeaderLength | ✓ | ✓ | ✓ | |
189 | ipHeaderLength | ✓ | ✓ | ✓ | |
190 | totalLengthIPv4 | ✓ | ✓ | ✓ | |
191 | payloadLengthIPv6 | ✓ | ✓ | ✓ | |
192 | ipTTL | ✓ | ✓ | ✓ | |
193 | nextHeaderIPv6 | ✓ | ✓ | ✓ | |
194 | mplsPayloadLength | ✓ | ✓ | ✓ | |
195 | ipDiffServCodePoint | ✓ | ✓ | ✓ | |
196 | ipPrecedence | ✓ | ✓ | ✓ | |
197 | fragmentFlags | ✓ | ✓ | ✓ | |
198 | octetDeltaSumOfSquares | ✓ | ✓ | ✓ | |
199 | octetTotalSumOfSquares | ✓ | ✓ | ✓ | |
200 | mplsTopLabelTTL | ✓ | ✓ | ✓ | |
201 | mplsLabelStackLength | ✓ | ✓ | ✓ | |
202 | mplsLabelStackDepth | ✓ | ✓ | ✓ | |
203 | mplsTopLabelExp | ✓ | ✓ | ✓ | |
204 | ipPayloadLength | ✓ | ✓ | ✓ | |
205 | udpMessageLength | ✓ | ✓ | ✓ | |
206 | isMulticast | ✓ | ✓ | ✓ | |
207 | ipv4IHL | ✓ | ✓ | ✓ | |
208 | ipv4Options | ✓ | ✓ | ✓ | |
209 | tcpOptions | ✓ | ✓ | ✓ | |
210 | paddingOctets | ✓ | ✓ | ✓ | |
211 | collectorIPv4Address | ✓ | ✓ | ✓ | |
212 | collectorIPv6Address | ✓ | ✓ | ✓ | |
213 | exportInterface | ✓ | ✓ | ✓ | |
214 | exportProtocolVersion | ✓ | ✓ | ✓ | |
215 | exportTransportProtocol | ✓ | ✓ | ✓ | |
216 | collectorTransportPort | ✓ | ✓ | ✓ | |
217 | exporterTransportPort | ✓ | ✓ | ✓ | |
218 | tcpSynTotalCount | ✓ | ✓ | ✓ | |
219 | tcpFinTotalCount | ✓ | ✓ | ✓ | |
220 | tcpRstTotalCount | ✓ | ✓ | ✓ | |
221 | tcpPshTotalCount | ✓ | ✓ | ✓ | |
222 | tcpAckTotalCount | ✓ | ✓ | ✓ | |
223 | tcpUrgTotalCount | ✓ | ✓ | ✓ | |
224 | ipTotalLength | ✓ | ✓ | ✓ | |
225 | postNATSourceIPv4Address | ✓ | ✓ | ✓ | |
226 | postNATDestinationIPv4Address | ✓ | ✓ | ✓ | |
227 | postNAPTSourceTransportPort | ✓ | ✓ | ✓ | |
228 | postNAPTDestinationTransportPort | ✓ | ✓ | ✓ | |
229 | natOriginatingAddressRealm | ✓ | ✓ | ✓ | |
230 | natEvent | ✓ | ✓ | ✓ | |
231 | initiatorOctets | ✓ | ✓ | ✓ | |
232 | responderOctets | ✓ | ✓ | ✓ | |
233 | firewallEvent | ✓ | ✓ | ✓ | |
234 | ingressVRFID | ✓ | ✓ | ✓ | |
235 | egressVRFID | ✓ | ✓ | ✓ | |
236 | VRFname | ✓ | ✓ | ✓ | |
237 | postMplsTopLabelExp | ✓ | ✓ | ✓ | |
238 | tcpWindowScale | ✓ | ✓ | ✓ | |
239 | biflowDirection | ✓ | ✓ | ✓ | |
240 | ethernetHeaderLength | ✓ | ✓ | ✓ | |
241 | ethernetPayloadLength | ✓ | ✓ | ✓ | |
242 | ethernetTotalLength | ✓ | ✓ | ✓ | |
243 | dot1qVlanId | ✓ | ✓ | ✓ | |
244 | dot1qPriority | ✓ | ✓ | ✓ | |
245 | dot1qCustomerVlanId | ✓ | ✓ | ✓ | |
246 | dot1qCustomerPriority | ✓ | ✓ | ✓ | |
247 | metroEvcId | ✓ | ✓ | ✓ | |
248 | metroEvcType | ✓ | ✓ | ✓ | |
249 | pseudoWireId | ✓ | ✓ | ✓ | |
250 | pseudoWireType | ✓ | ✓ | ✓ | |
251 | pseudoWireControlWord | ✓ | ✓ | ✓ | |
252 | ingressPhysicalInterface | ✓ | ✓ | ✓ | |
253 | egressPhysicalInterface | ✓ | ✓ | ✓ | |
254 | postDot1qVlanId | ✓ | ✓ | ✓ | |
255 | postDot1qCustomerVlanId | ✓ | ✓ | ✓ | |
256 | ethernetType | ✓ | ✓ | ✓ | |
257 | postIpPrecedence | ✓ | ✓ | ✓ | |
258 | collectionTimeMilliseconds | ✓ | ✓ | ✓ | |
259 | exportSctpStreamId | ✓ | ✓ |