NetFlow

The ListenNetFlow Processor supports receiving NetFlow Export Packets over UDP for the following versions of NetFlow:

• Version 1
• Version 5
• Version 9

Reference Specifications

The Cisco NetFlow Export Diagram Format describes the protocol structure for NetFlow Versions 1 and 5.

RFC 3954 defines the protocol structure for NetFlow Version 9.

The Internet Assigned Numbers Authority maintains a registry of IP Flow Information Export Entities based on RFC 7012. The IPFIX Information Elements defined in the registry include field names and data types that support decoding NetFlow Record Fields.

Record Schema

The ListenNetFlow Processor reads binary NetFlow Export Packets and transforms the information into a standard schema for record-oriented processing.

The NetFlow Record Schema contains both standard fields and template-based fields to support representing NetFlow Records using a common structure.

The NetFlow Record Schema consists of the following Record Fields with corresponding Data Types:

The fields element contains one or more NetFlow Record Fields with field names defined according to the IPFIX Information Elements registry regardless of NetFlow protocol version.

The fields element values can be different types depending on the data type defined for decoding in the IPFIX Information Elements registry. The ListenNetFlow Processor converts Internet Protocol Addresses to standard string representations and converts Media Access Control Addresses to hexadecimal strings with semicolon separators between octets.

NetFlow Version 9 Records

NetFlow Version 9 uses templates that define how to decode NetFlow Records. NetFlow Version 9 supports both FLOW and OPTIONS Data Record Types.

Options Data Records contain information about the NetFlow Exporter. Standard NetFlow Data Records contain information about Internet Protocol communication.

NetFlow Version 9 Records use Packet Header and Data Record elements to create records according to the NetFlow Record Schema.

A NetFlow Version 9 Data Record can have the following Record Schema elements defined as follows:

NetFlow Version 5 Records

NetFlow Version 5 uses a standard Flow Record structure defined in Table B-4 of the NetFlow Export Datagram Format. NetFlow Version 5 produces FLOW Data Record Types.

NetFlow Version 5 does not use templates and does not support the concept of an observation domain source identifier, so the Processor sets the following fields to 0 when creating NetFlow Records.

• packetSourceId
• flowSetId

A NetFlow Version 5 Data Record can have the following Record Schema elements defined as follows:

A NetFlow Version 5 Data Record will have a standard set of elements in the fields element based on the NetFlow Version 5 specification.

A NetFlow Version 5 fields element will be serialized as follows:

NetFlow Version 1 Records

NetFlow Version 1 uses a standard Flow Record structure defined in Table B-2 of the NetFlow Export Datagram Format. NetFlow Version 1 produces FLOW Data Record Types.

NetFlow Version 1 does not use templates and does not support the concept of an observation domain source identifier or sequence number, so the Processor sets the following fields to 0 when creating NetFlow Records.

• packetSequenceNumber
• packetSourceId
• flowSetId

A NetFlow Version 1 Data Record can have the following Record Schema elements defined as follows:

A NetFlow Version 1 Data Record will have a standard set of elements in the fields element based on the NetFlow Version 1 specification.

A NetFlow Version 1 fields element will be serialized as follows: