# Netflow v9/IPFIX Template Not Receieved

NetObserv Flow’s log indicates, `Could not decode flowsets: template not yet received`.

### SYMPTOM

The NetObserv Flow's log indicates a message similar to the following:

```log
error netflow9/netflow9.go:59        netflow v9: could not decode flowsets: template not yet received from 10.1.1.1 for session: 27856, observation domain: 33312, template ID 260
```

This may occur for both Netflow v9 and IPFIX.

### PROBLEM

Unlike earlier versions of Netflow, Netflow v9 and IPFIX do not contain a static set of information elements (IEs). The vendor can decide which [standard IEs](https://www.iana.org/assignments/ipfix/ipfix.xhtml) they wish to send, as well as any vendor-defined IEs.

For the collector to be able to decode Netflow v9 and IPFIX records, it needs a description of the contents that the flow exporter will be sending. This is called a *template*. The collector will be unable to decode any flow record for which it has not yet received a template. As such, this error message indicates that is still waiting to receive a template from the device.

### SOLUTION

In most cases, waiting will allow the issue to resolve itself. These messages will likely be seen when starting NetObserv Flow, but should stop appearing after the needed templates have been received. Devices will usually send templates every few minutes, although some may take 15-30 minutes. This interval is usually configurable, but it may vary by vendor and model.

If waiting does not solve the problem, subscription customers can contact [support](mailto:support@elastiflow.com). Community users can reach out to us via the [ElastiFlow Community Slack](https://join.slack.com/t/elastiflowcommunity/shared_invite/zt-3ua41906f-5uM4aJSXO5vpJHlq4j8xhQ). To investigate we will need a PCAP of the incoming records from the device in question. The PCAP will need to be long enough to include templates.

The following `tcpdump` example will capture incoming packets to port `2055` from `192.0.2.11` and write them to a file named `netflow.pcap`.

```shell
sudo tcpdump "src 192.0.2.11 and udp port 2055" -w netflow.pcap -vvv
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.elastiflow.com/additional-resources-reference-articles/faq/flow_template_not_received.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.