Cisco Systems OL-6900-01 manual NetFlow Data Export Formats

Chapter 1 Overview

What Are NetFlow Services?

•Version 5 datagrams, up to 30 flows can be sent in a single UDP datagram of approximately 1500 bytes.

•Version 7 datagrams, up to 27 flows can be sent in a single UDP datagram of approximately 1500 bytes.

•Version 8 datagrams, the number of flows sent in a single UDP datagram varies by aggregation scheme.

•Version 9 datagrams, the number of flows is variable, and depends on the number and size of fields defined in one or more templates.

See Appendix B, “NetFlow Export Datagram Formats,” in the CNS NetFlow Collection Engine User Guide for details on all versions of the NetFlow data export format.

NetFlow Data Export Formats

NetFlow exports flow information in UDP datagrams in one of five formats: Version 1 (V1), Version 5 (V5), Version 7 (V7), Version 8 (V8), or Version 9 (V9).

Version 1 is the original format supported in the initial NetFlow releases. Version 5 is an enhancement that adds Border Gateway Protocol (BGP) autonomous system information and flow sequence numbers. Version 7 is an enhancement that exclusively supports Cisco Catalyst 5000 series switches equipped with a NetFlow feature card (NFFC). V7 is not compatible with Cisco routers. Version 8 is an enhancement that adds router-based aggregation schemes. Version 9 is an enhancement to support different technologies such as Multicast, Internet Protocol Security (IPSec), and Multi Protocol Label Switching (MPLS). CNS NetFlow Collection Engine Release 5.0 can collect, filter, and aggregate Version 9 data in the same way it does for NetFlow Data Export Versions 1 through 8.

Versions 2, 3, 4, and 6 are not supported by CNS NetFlow Collection Engine. For more information on the distinctions among the NetFlow data export formats, see Appendix B, “NetFlow Export Datagram Formats,” in the CNS NetFlow Collection Engine User Guide.

The following types of information are part of the detailed traffic statistics:

•Source and destination IP addresses

•Next hop address

•Input and output interface numbers

•Number of packets in the flow

•Total bytes (octets) in the flow

•First and last time stamps of packets that were switched as part of this flow

•Source and destination port numbers

•Protocol

•Type of service (ToS)

•Source and destination autonomous system (AS) numbers, either origin or peer (present in V5 and select V8 datagrams)

•Source and destination prefix mask bits (present in V5, V7, and V8 datagrams)

•Shortcut router IP address (present in V7 on Cisco Catalyst 5000 series switches only).

Cisco CNS NetFlow Collection Engine User Guide, Release 5.0.2

OL-6899-01 1-3