33-4
Catalyst 6500 Series Switch Cisco IOS Software Configuration Guide—Release 12.1 E
78-14099-04
Chapter 33 Configuring NDE
Understanding How NDE Works
Table 33-2 NDE Version 5 Flow Record Format
Bytes Content Description
Flow masks:
• X=Populated
• A=Additional field (see the “Populating Additional NDE Fields”
section on page 33-10)
Destination
Destination
Source
Destination
Source
Interface1
1. Supported in Release 12.1(13)E and later releases.
Full
Full
Interface1
0–3 srcaddr Source IP address XXXX
4–7 dstaddr Destination IP address XXXXX
8–11 nexthop Next hop router’s IP address A2
2. With the destination flowmask, the “Next hop router’s IP address” field and the “Output interface’s SNMP ifIndex” field might not contain information
that is accurate for all flows.
AAAA
12–13 input Ingress interface SNMP ifIndex XX
14–15 output Egress interface SNMP ifIndex A2AAAA
16–19 dPkts Packets in the flow XXXXX
20–23 dOctets Octets (bytes) in the flow XXXXX
24–27 first SysUptime at start of the flow XXXXX
28–31 last SysUptime at the time the
last packet of the flow was received
XXXXX
32–33 srcport Layer 4 source port number
or equivalent
XX
34–35 dstport Layer 4 destination port number
or equivalent
XX
36 pad1 Unused (zero) byte
37 tcp_flags Cumulative OR of TCP flags
38 prot Layer 4 protocol
(for example, 6=TCP, 17=UDP)
XX
39 tos IP type-of-service byte
40–41 src_as Autonomous system number of the
source, either origin or peer
AAAA
42–43 dst_as Autonomous system number of the
destination, either origin or peer
AAAAA
44–45 src_mask Source address prefix mask bits
46–47 dst_mask Destination address prefix mask bits
48 pad2 Pad 2